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SUMMARY 


The  NMAB  Committee  on  Assurance  of  Structural  Integrity  was  formed  to 
investigate  and  document  the  need  for  a  formal  structural  integrity 
assurance  program  for  employment  by  the  U.S.  Army.  The  perceived  need  for 
such  a  program  stems  from  occasional  structural  failures  in  Army  weapons  and 
transportation  systems,  which,  although  few  in  number,  have  had  a 
significant  cumulative  impact  economically,  in  terms  of  injuries  or  death  to 
personnel  or  upon  mission  success. 

As  a  result  of  a  review  of  failures  as  well  as  of  procedures  employed  in 
industry  and  government  to  preclude  failures,  a  strong  committee  consensus 
developed  suggesting  that  a  formal  structural  integrity  assurance  program 
would  be  highly  desirable  in  Army  system  development  and  procurement. 
Important  features  of  a  recommended  structural  integrity  program  are 
proposed  whereby  the  basic  pattern  of  existing  Air  Force  regulations 
(ASIP/ENSIP)  is  followed,  but  allowing  more  flexibility  in  implementation 
because  of  the  wide  diversity  of  Army  equipment  and  systems.  Details  of  the 
organization  and  operational  aspects  of  such  a  program  were  not  considered 
in  the  belief  that  the  committee  recommendations  might  best  be  achieved  by 
the  full  and  direct  involvement  of  the  Army  itself  in  developing  the 
detailed  plan. 

Finally,  the  committee  report  summarizes  anticipated  payoffs  and 
benefits  of  the  proposed  program  in  terms  of  the  major  reasons  for  its 
implementation,  which  include  cost,  safety,  readiness,  visibility, 
maintenance,  and  political  factors. 
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INTRODUCTION 

The  sudden  and  unexpected  failure  of  engineering  structures  can  have  serious 
human  and  economic  consequences.  Numerous  examples  can  be  cited  where  the 
loss  of  life  is  high  and  the  resulting  costs  are  severe.  The  walkway 
collapse  at  the  Hyat t-Regency  Hotel  in  Kansas  City  (National  Bureau  of 
Standards  1982),  the  American  Airlines  DC-10  engine  separation  and  crash  in 
Chicago  (National  Transportation  Safety  Board  1979),  and  the  1-95  bridge 
failure  in  Connecticut  (Newsweek  1983)  are  examples  of  major  failures  that 
have  compromised  public  safety. 

Many  other  premature  failures  occurring  in  structural  components  may 
pass  unnoticed  by  the  public  but  may  have  important  economic  consequences 
for  the  manufacturer,  the  user,  or  the  taxpayer.  The  collapse  of  welded  oil 
storage  tanks  (National  Research  Council  1953a)  and  the  sudden  fracture  of 
large  generator  rctors  (Schabtach  et  al.  1955),  events  that  occurted  in  the 
1950s,  are  representative  of  very  costly  component  failures. 

Visibility — public  awareness — is  another  concern  in  reckoning  with  the 
possibility  of  sudden  failure.  Perhaps  no  event  is  more  visible  to  the 
public  than  the  launching  of  man  into  space.  The  subsequent  political  and 
programmatic  consequences  of  a  structural  failure  at  the  time  that  national 
television  is  giving  its  full  attention  to  the  event  can  be  anticipated  to 
be  extreme.  Safety,  cost,  and  visibility  are  only  three  of  many  factors  on 
which  this  class  of  failures  impact. 

The  causes  of  such  failures  are  many,  and  examples  of  each  will  be 
presented  here.  They  include: 

1.  Improper  recognition  of  loading  conditions. 

2.  Material  and  design  factors  contributing  to  instability. 

3.  Quality  of  manufacture  of  the  finished  product. 

u.  Material  damage  from  prior  service. 


3 


Structural  Integrity  Program — A  set  of  requirements  that  must  be 
considered  to  ensure  structural  integrity  for  a  class  of  structures.  The 
requirements  normally  are  established  to  preclude  historical  causes  of 
failure. 

Structural  Integrity  Plan — A  scheme  for  implementing  the  structural 
integrity  program  for  a  specific  structure. 

Durabi lity--The  ability  of  the  structure  to  resist  cracking,  corrosion, 
thermal  degradation,  material  changes,  wear,  delamination,  and  the  effects 
of  other  time-dependent  damage  for  a  specified  period  of  time  (or  operation). 

Damage  Tolerance — The  ability  of  the  structure  to  resist  failure  due  to 
the  presence  of  flaws,  cracks,  or  other  damage  for  a  specified  period  of 
ope  ra  t ion . 

Usage — A  description  of  how  the  structure  is  used  in  terms  of  the 
environment  and  loading  to  which  the  structure  is  subjected. 

Quality — A  description  of  defects,  dimensional  variations,  and 
discrepancies  within  a  structure  that  could  directly  cause  or  lead  to 
failure. 

THE  REASON  FOR  STRUCTURAL  INTEGRITY  PROGRAMS 

An  engineering  system  is  designed  to  meet  specific  performance  requirements 
and  a  structural  design  engineer  must  balance  these  overall  system 
requirements  with  the  requirement  for  structural  integrity.  It  normally  is 
not  possible  to  meet  overall  requirements  without  some  degree  of  structural 
integrity.  Unfortunately,  the  direct  ties  between  overall  requirements  and 
the  structural  integrity  requirements  are  not  always  clear. 

As  an  engineering  system  develops,  the  overall  requirements  are 
interpreted  in  terms  of  trade-offs  between  budgetary  and  performance 
requirements.  The  trade-off  studies  tend  to  emphasize  those  performance 
goals  most  closely  tied  to  an  acceptable  demonstration  of  contractual 
compliance  (or  lack  of  subsequent  liability).  Thus,  to  ensure  structural 
integrity,  it  is  necessary  to  have  clearly  defined  structural  performance 
requirements  (goals)  that  can  be  demonstrated.  The  structural  performance 
demonstration  should  be  conducted  prior  to  initiating  a  contractual 
commitment  that  releases  the  manufacturer  from  liability  and  burdens  the 
customer  with  unwanted  structural  failure  problems.  From  a  cost  standpoint, 
it  is  important  that  the  structural  performance  requirements  be  as  clearly 
defined  as  the  overall  system  requirements. 

It  is  the  purpose  of  structural  integrity  programs  to  provide  system 
program  managers  and  design  engineers  with  a  set  of  structural  performance 
requirements  that,  if  met,  should  ensure  a  low  risk  of  structural  failure. 

The  set  of  structural  performance  requirements  may  dictate  preparation  of 
specific  failure  cause  and  effect  evaluations  as  well  as  definition  of 
overall  structural  system  performance. 
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STRUCTURAL  INTEGRITY  CONCEPTS 


The  engineering  concepts  and  processes  that  have  ev  Ived  to  systematically 
prevent  structural  failures  are  described  in  this  chapter.  It  should  be 
noted,  however,  that  the  historical  causes  of  failure  for  a  given  class  of 
structures  are  fairly  unique  to  that  class  of  structures.  Therefore,  the 
details  associated  with  how  a  specific  industry  addresses  the  failures  most 
prevalent  in  their  class  of  structures  may  be  unique  to  that  industry.  In 
an  attempt  to  facilitate  a  better  understanding  of  the  terms  used  to 
describe  the  concepts  and  processes  of  preventing  failure,  a  list  of 
definitions  is  included.  Specific  note  is  drawn  to  the  definitions  of  a 
structural  integrity  program  and  of  a  structural  integrity  plan.  The 
remaining  sections  of  the  chapter  provide  an  overview  of  the  engineering 
concepts  and  processes  associated  with  failure  prevention. 

DEFINITIONS 

Structure — A  mechanical  body  (e.g.,  bridge),  composed  of  one  or  more 
elements,  whose  function  is  to  resist  forces  (loads).  The  forces  may 
develop  from  contact,  pressure,  gravitational,  inertial,  magnetic  and 
thermal  sources  and  may  result  in  axial,  shear,  bending,  and  torsional 
deformations.  The  forces  could  be  static  (constant),  repeated 
( eye  1 ic /f at igue ) ,  transient,  or  sudden  (impact). 

Failure — Any  change  that  renders  the  structure  incapable  of 
satisfactorily  performing  its  required  function.  For  example,  the  presence 
of  a  crack  may  lead  to  a  loss  of  force  (load)  carrying  capability  and/or 
excessive  deformation. 

Structural  Integrity--A  performance  characteristic  for  a  structural 
system.  The  structural  system  will  perform  its  function  each  time  that  it 
is  used  for  as  long  as  intended  without  failure. 

Structural  Reliability — The  probability  that  a  structural  system  will 
perform  its  function  without  failure.  Typically,  this  probability  depends 
on  the  time  in  service,  the  number  of  times  that  the  system  is  used,  or  both. 
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Fracture  costs  to  the  Department  of  Defense  can  be  roughly  estimated 
to  be  $6  billion  per  year.  Costs  of  about  $2  billion  per  year  are 
currently  reducible  through  utilization  of  the  best  fracture  control 
practice.  The  majority  of  the  currently  reducible  costs  are  probably 
associated  with  the  Army  since  the  Air  Force  and  Navy  have  identifiable 
structural  integrity  programs  and  associated  fracture-control  plans  in 
practice . 

Fracture-related  accidents  contributed  to  the  Department  of  Defense 
costs.  The  following  table,  using  1979  data  from  safety  centers  of  the  3 
services  (Duga  et  al.  1983),  summarizes  the  accident  contribution. 


TABLE  1  Summary  of  Fracture-Related  Accidents  in  the  Army,  Navy,  and 
Air  Force 


Service 

Total  No.  of 
Accidents 

On-Duty 

Accidents 

No.  Due  to 
Fracture 

%  Due  to 
Fracture 

Army 

20,561 

16,040 

900 

4.4 

Navy 

16,048 

12,892 

199 

1.2 

Air  Force 

15,015 

7,999 

97 

0.7 

The  contribution  from  the  Army  is  3  times  greater  than  the  sum  of  the  Navy 
and  Air  Force  accidents. 

Based  on  the  above  background  and  on  the  premise  that  recently 
developed  structural  integrity  concepts  could  assure  reliable  performance  if 
a  well-defined  method  was  followed,  the  committee  decided  to  examine 
fracture  control  programs  currently  used  and  to  recommend  any  features  of 
such  programs  that  could  be  utilized  by  the  Army.  The  committee  chose  to 
describe  its  task  as  follows: 

1.  Review  structural  integrity  assurance  methodologies  currently  used 
by  government  and  industry. 

2.  Evaluate  and  document  the  need  for  and  cost-effectiveness  of  these 
methodologies . 

3.  Assess  the  merits  of  requiring  use  of  similar  plans  by  the  Army  in 
the  acquisition  of  systems  in  which  structural  failures  could  jeopardize 
personnel  or  mission  success. 

This  procedure,  as  well  as  alternate  methods  of  accomplishing  the  result, 
were  considered.  This  report  addresses  these  tasks. 
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FIGURE  7  Collapse  of  Silver  Bridge  at  Point  Pleasant,  Ohio  (Lichtenstein 
1970) . 


enforced  in  some  cost-effective  way.  It  is  questions  such  as  these  that 
occupied  the  committee's  attention,  rather  than  the  more  technical  issues 
such  as  crack  detection  methodology  or  specific  material  performance. 

The  cost  of  fracture  is  high.  A  study  of  the  cost  of  failures  due  to 
fracture  in  the  United  States  has  recently  been  performed  by  the  National 
Bureau  of  Standards  and  Battelle  Memorial  Institute  (Reed  et  al.  1983). 
The  costs  were  estimated  to  be  very  large,  $119  billion  per  year  in  1982 
dollars.  Costs  from  the  occurrence  of  fracture  and  from  the  prevention 
of  fracture  were  included.  Preventive  costs  include  packaging  and 
handling,  maintenance  and  repair,  quality  control  and  service  inspection, 
training,  research,  and  codes  and  standards  development.  The  study 
estimated  that  these  large  costs  could  be  reduced  by  more  than  $33 
billion  per  year  through  extensive  use  of  available  technology  directed 
toward  more  effective  and  efficient  fracture  control.  Fracture-related 
research  could  further  reduce  these  costs  by  about  $28  billion  per  year. 


common.  This  form  of  damage  can  lead  to  dramatic  consequences  when  a 
critical  crack  size  is  reached  and  unstable  fracture  ensues.  This  process 
has  already  been  cited  in  the  case  of  the  Comet  crashes.  It  was  also 
responsible  for  the  fairly  recent  DC-10  accident  in  Chicago  (National 
Transportation  Safety  Board  1979).  In  this  case,  a  large  fatigue  crack  in 
an  engine  mount  was  initiated  by  severe  (and  improper)  maintenance 
procedures  associated  with  the  removal  and  installation  of  replacement 
engines.  Engine  separation  during  takeoff  resulted  when  the  crack  had 
propagated  to  a  critical  size. 

Another  cause  of  material  damage  arises  from  stress  and  environmental 
interactions  with  the  structural  material  employed.  A  form  of  such  damage 
is  known  as  stress  corrosion  cracking  and  has  led  to  a  number  of 
unanticipated  structural  failures,  one  of  which  was  the  collapse  of  the 
Silver  Bridge  at  Point  Pleasant,  Ohio,  in  1967,  in  which  47  people  were 
killed  (Bennett  and  Mindlin  1973).  The  bridge  (Figure  7)  was  a  suspension 
type  where  the  cable  was,  in  fact,  a  series  of  connecting  eyebars.  Over  the 
course  of  time  a  crack  developed  in  one  of  the  eyes  until  it  reached  a 
critical  size  (about  0.12  in.)  for  fracture  by  the  normal  working  stress. 

The  crack  initiated  from  some  combination  of  fatigue,  stress  corrosion,  and 
corrosion  fatigue.  The  high  hardness  of  the  steel,  its  low  fracture 
toughness,  the  creviced  nature  of  the  geometry,  and  the  impossibility  of 
protecting  the  eyebolt  from  the  weather  were  all  contributing  factors  to  the 
failure . 

Thus,  serious  structural  failures  result  for  many  reasons  including 
uncertainty  in  the  loading,  the  presence  of  unanticipated  defects, 
inadequate  design,  poor  material  behavior  and  the  nature  of  the  service. 
Other  possibilities  include  lack  of  proper  maintenance  and  professional 
incompetence.  The  causes  of  a  structural  failure  usually  are  identified 
after  the  fact  but  the  goal  is  to  recognize  the  deficiencies  before  a 
problem  occurs.  This  subject  is  receiving  increasing  attention  in  industry 
and  government,  and  a  structural  integrity  discipline  is  now  emerging. 
Engineering  concepts  and  processes  have  been  developed  to  prevent  structural 
failures  by  systematically  providing  for  consideration  of  all  known  causes 
for  failure  in  a  specific  structure  and  by  guiding  and  controlling  the 
functions  of  design,  manufacturing,  and  in-service  operation  to  ensure  a  low 
risk  of  structural  failure.  These  concepts,  however,  have  not  been  widely 
adopted . 

The  U.S.  Army  has  experienced  unexpected  and  not  very  well  known 
structural  failures.  In  one  case,  an  anti-tank  weapon  exploded  during  a 
demonstration  (Hackley  1983).  It  was  designated  the  light  anti-tank  weapon 
(LAW),  a  disposable  rocket  launcher  made  from  a  low-ductility  aluminum 
alloy.  Although  the  cause  of  the  accident  is  unknown,  the  choice  of 
material  was  believed  to  be  the  principal  factor  in  earlier  LAW  failures. 
Another  case  of  structural  failure  involves  the  Army's  high  mobility 
multipurpose  wheeled  vehicle  (HUMMER).  A  major  complaint  has  been  its  low 
reliability  due  to  engine  and  drive  train,  suspension,  and  weapon  mount 
malfunctions  or  fractures  (New  York  Times  1983). 

Cases  such  as  these  raise  questions  concerning  whether  adequate 
engineering  could  have  foreseen  and  precluded  such  failures  and  whether 
adequate  design  and  material  selection  procedures  could  have  been 


FIGUkh  Walkways  at  the  Kansas  Hyatt  Regency  shortly  after  the 
collapse  (reprinted  by  permission  of  the  Kansas  Citv 
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FIGURE  I  Tacoma  Narrows  Bridge  showing  torsional  oscillation  one  hour  before  failure 
(Paine  et  al.  1944). 
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The  failure  of  the  Tacoma  Narrows  Bridge  (Paine  et  al.  1944)  is  an 
example  of  improper  recognition  of  loading.  This  bridge  had  one  of  the 
longest  spans  for  a  suspension  bridge  when  it  was  completed  in  1940. 

Although  it  presented  a  graceful  and  pleasing  profile,  its  slenderness  made 
it  aerodynamically  unstable;  it  developed  severe  oscillations  in  the 
prevailing  winds  of  the  Narrows  and  soon  twisted  itself  apart  in  a  high, 
sustained  wind  (Figures  1  and  2).  The  problem  arose  because  of  improper 
consideration  of  the  wind  conditions  and  the  dynamic  response  of  the  slender 
bridge  structure  to  those  winds.  Wind  tunnel  tests  verified  the  cause  and, 
subsequently,  became  a  consideration  in  bridge  design. 

Although  Griffith  (1920)  developed  the  basic  concept  describing  the 
brittle  fracture  of  glass  in  1920,  stability  against  sudden  fracture  did  not 
become  a  vital  issue  until  World  War  II  when  over  200  all-welded  ships 
experienced  brittle  fracture  (National  Research  Council  1953b)  (Figure  3). 

In  this  case,  the  loss  in  fracture  ductility  with  decreasing  temperature  in 
ferritic  steels  used  for  ship  plate  was  an  important  contributing  factor  to 
cracking  (low  fracture  toughness)  as  was  a  design  employing  hatches  with 
square  corners  (high  stress  intensity  factor).  Full  recognition  of  the 
importance  of  fracture  toughness  and  the  stress-intensity  factor  in  the 
failure  of  engineering  structures  did  not  occur  until  the  late  1940's. 

Another  example  of  instability  was  the  catastrophic  failure  of  two 
de  Havilland  Comet  jet  airplanes  in  the  mid-1950s  (Bishop  1955).  This  plane 
was  the  first  passenger  plane  of  this  type  to  be  introduced  for  commercial 
use.  Cyclic  pressurization  of  the  cabin  led  to  the  development  and  growth 
of  small  fatigue  cracks  from  rivet  holes  in  window  corners  causing  the 
structure  to  become  unstable  and  to  burst  dramatically  in  mid-air 
(Figure  4).  These  failures  were  death  blows  to  the  Comet  and  a  severe 
setback  to  British  commercial  jet  aviation  for  many  years  hence. 

Many  failures  in  which  the  quality  of  manufacture  of  the  finished 
product  was  a  major  factor  can  be  described.  One  fairly  recent  case  is  that 
of  the  elevated  walkways  of  the  Hyatt  Regency  Hotel  in  Kansas  City  (National 
Bureau  of  Standards  1982).  In  this  case,  an  on-site  change  in  the  method  of 
support  of  the  walkway  led  to  tragedy.  In  July  1981,  a  crowd  was  gathered 
on  the  walkways  as  well  as  in  the  lobby  below  when  the  walkways  suddenly 
collapsed  (Figure  5).  Although  it  was  later  determined  from  detailed 
testing  that  even  the  original  design  was  inadequate  for  the  imposed  load,  a 
change  had  been  introduced  during  construction  that  doubled  the  load  on  the 
box  beam  bearing  surface  of  the  fourth  floor  walkway  by  the  rods  suspended 
from  the  ceiling,  causing  the  rod  to  pull  through  the  box  beam  (Figure  6). 

Material  damage  in  service  is  also  a  major  source  of  premature  failure. 
The  principal  cause  is  fatigue,  a  process  of  crack  initiation  and  growth 
arising  from  cyclic  loading.  Since  crack  initiation  is  greatly  accentuated 
by  local  stress  raisers  (e.g.,  notches),  material  defects  (e.g., 
inclusions),  and  a  wide  variety  of  surface  conditions  and  since  most 
structures  are  subjected  to  cyclic  loading,  cracking  from  this  cause  is 


ELEMENTS  OF  A  STRUCTURAL  INTEGRITY  PROGRAM 


AIL  structural  integrity  programs  must  direct  adequate  attention  to  the 
following  five  elements: 

1.  Structural  design  conditions 

a.  Design  life 

b.  Loads 

c .  Environment 

d.  Damage  assumptions 

2.  Materials  and  processing  controls 

a.  Selection 

b.  Properties 

c .  Spec  i  f icat ions 

3.  Design  and  analysis  controls 

a.  Design  concepts 

b.  Failure  modes  and  effects  analysis 

c.  Stress  analysis 

d.  Fatigue  analysis 

e.  Fracture  mechanics  analysis 

f.  Joining  practices 

4.  Quality  assurance  controls 

a.  Material/fabrication/processing  controls 

b.  Inspection 

c.  Verification  or  qualification  testing  (strength,  life,  and  operation 

5.  In-service  controls 

a.  Usage  monitoring 

b.  Maintenance 

c.  Inspection 

d.  Repair 

These  elements  include  all  the  factors  that  are  to  be  considered  during 
design,  fabrication,  and  operation  to  assure  a  satisfactory  level  of 
structural  integrity  during  the  service  life  of  the  structure. 

The  structural  design  conditions  provide  the  basis  for  sizing  the 
structure  to  protect  against  failure.  They  define  the  expected  service 
life,  the  operating  environment  (loading,  chemical,  and  thermal  history), 
and  the  uncertainties  associated  with  structural  and  material  quality  and 
the  operating  environment.  Materials  and  processing  controls  are  used  to 
select  the  materials  for  fabrication,  to  establish  their  mechanical 
properties,  and  to  ensure  that  the  materials  conform  to  the  requirements  of 
material  and  processing  specifications  applicable  to  the  given  structure. 

The  design  and  analysis  controls  establish  the  configuration  and  sizing  of 
the  structure  such  that  it  can  reliably  meet  its  strength  and  life 
objectives. 
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Quality  assurance  controls  are  used  to  ensure  that  the  as-fabricated 
structure  conforms  to  the  design  requirements.  These  controls  are 
established  to  ensure  quality  throughout  the  design,  fabrication, 
installation,  and  service  life  of  the  structure  and  include  verification  (or 
demonstration)  testing. 

In-service  controls  ensure  that  the  structure  maintains  the  required 
level  of  structural  integrity  throughout  its  service  life.  When  necessary, 
the  structure  is  periodically  inspected  and  repaired  as  required,  and 
sometimes  the  operational  history  is  monitored. 

Historically,  two  different  approaches  have  evolved  for  applying 
structuial  integrity  programs  (McHenry  and  Rolfe  1980).  The  first  is  based 
on  the  use  of  design  and  fabrication  codes  and  the  second  is  based  on 
performance  specifications.  The  type  of  structural  integrity  program  is 
frequently  dictated  by  the  type  of  structure  that  is  being  designed  and 
fabricated . 


STRUCTURAL  INTEGRITY  PLAN 

Given  the  definition  of  the  structural  integrity  requirements  for  a  selected 
structural  system,  the  necessary  framework  can  be  developed  to  ensure  that 
these  requirements  are  demonstrated.  The  structural  integrity  plan  provides 
the  mechanism  for  meeting  the  requirements.  It  defines  the  analytical 
framework  and  the  procedures  that  will  be  developed  and  implemented  to 
protect  the  structure  from  failure  throughout  its  service  life. 

To  assure  that  the  structural  system  maintains  a  defined  level  of 
structural  integrity  (or  structural  reliability)  throughout  its  service 
life,  it  is  necessary  to  relate  materials,  structural  configuration 
(geometry),  usage,  and  quality  type  information  to  potential  modes  of 
failure  and  to  life  estimates.  Mechanics  is  the  science  that  provides  the 
analytical  framework  for  conducting  a  series  of  analyses  that  balance 
structural  integrity  requirements  with  structural  capability  (Figure  8). 
Mechanics  is  used  to  calculate  relationships  between  external  loadings  and 
the  internal  conditions  that  define  failure.  This  science  integrates  the 
influences  of  material  behavior  and  geometry  into  the  relationships  so  that 
effects  of  material  changes  and  geometrical  sizing  or  configurations  can  be 
analyzed . 

Basic  structural  analyses  deal  with  bulk  calculations;  more  advanced 
analyses  deal  with  the  influence  of  cracks.  The  basic  bulk-material  type 
analyses  are  concerned  with  precluding  the  simpler  modes  of  failure  due  to 
overloads,  excessive  deformation,  buckling,  etc. 

Most  structural  integrity  analyses  use  deterministic  values  to  describe 
the  relationships  between  structural  geometry,  materials  of  construction, 
quality  of  workmanship,  and  operational  usage  assumptions  (Figure  8).  The 
deterministic  values  are  established  as  worst-case  estimates  so  that  the 
likelihood  of  fracture  is  remote  (but  undefined). 
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FIGURE  8  Informational  elements  that  must  be  modeled  in  a  structural 
integrity  analysis. 


Structural  reliability  calculations  normally  are  conducted  utilizing 
statistical  descriptions  of  each  of  the  four  informational  elements  shown  in 
Figure  8  to  estimate  the  probability  for  different  types  of  failure  as  a 
function  of  time  in  service.  The  structural  reliability  calculations 
utilize  the  same  analytical  framework  employed  for  the  deterministic 
descriptions  of  the  input.  Typically,  sensitivity  studies  are  conducted  to 
establish  the  importance  of  the  deterministic  inputs  to  the  final  estimate 
of  structural  integrity. 
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The  analytical  framework  integrating  the  informational  elements  shown  in 
Figure  8  is  supported  by  empirical  information  based  on  test  results  and 
operational  experience.  Quantification  of  the  informational  elements  can  be 
both  difficult  and  inexact.  The  incorporation  of  new  concepts  (whether 
associated  with  materials,  configurations,  operations,  or  quality  assurance) 
always  leads  to  inaccuracies  that  decrease  the  confidence  in  structural 
reliability.  For  structural  applications,  materials  behavior  is  quantified 
through  the  use  of  the  mechanical  properties  (yield  strength,  elastic 
modulus,  crack  growth  resistance,  etc.).  Configurations  are  evaluated  based 
on  structural  efficiency  factors  that  measure  load  carrying  capability,  load 
transferred,  damage  tolerance,  stiffness,  etc.  Operational  usage  is  defined 
by  load  and  environmental  spectra  that  are  characterized  with  a  set  of 
extreme  conditions  or  with  a  sequence  of  ordered  load  and  environmental 
events.  Quality  assurance  is  quantified  based  on  surface  characterizations, 
nondestructive  evaluations,  destructive  testing,  and  other  procedures  that 
are  difficult  to  quantify.  For  additional  discussion  of  the  technologies 
that  support  structural  integrity  plans  see  Pellini  (1976)  and  Gallagher  and 
Crooker  (1979). 

Prior  to  applying  a  structural  integrity  plan,  it  is  necessary  to  fully 
ascertain  the  potential  causes  of  failure  and  to  define  the  importance  of 
each  of  the  elements  shown  in  Figure  8  to  the  different  types  of  failure. 
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EXAMPLES  OF  STRUCTURAL  INTEGRITY  PROGRAMS 


This  chapter  describes  a  number  of  structural  integrity  programs  that  are 
currently  employed  to  ensure  the  safety  and  reliability  of  equipment 
designed,  sold,  procured,  regulated,  or  used  by  government  and  commercial 
organizations.  Each  program  has  evolved  to  define  and  emphasize  design, 
manufacturing,  and  in-service  elements  that  require  controls  if  one 
wishes  to  preclude  failures  of  a  type  historically  experienced  by  the 
class  of  structures  covered  by  the  program.  Some  programs  described  are 
unique  to  a  specific  organization;  this  is  particularly  the  case  for 
commercial  organizations  that  design,  manufacture,  sell,  and  service 
equipment.  Other  programs  have  become  industry  standards;  these 
programs  are  typically  imposed  on  industry  by  a  government  organization 
that  regulates,  procures,  uses,  and/or  maintains  the  equipment.  All 
programs  examined  have  improved  the  safety  and  reliability  of  the 
equipment  in  the  field  because  of  profit  stimulation,  product  reputation, 
or  government  requirements. 


STRUCTURAL  INTEGRITY  ASSURANCE  PROGRAM  IN  THE 
COMMERCIAL  NUCLEAR  POWER  INDUSTRY* 

Purpose 

The  primary  objective  of  the  structural  integrity  program  in  the  nuclear 
power  industry  is  the  assurance  of  plant  safety.  Structural  failures  in 
equipment  and  structures  important  to  plant  safety  could  lead  to  a 
malfunction  of  that  equipment  and,  in  severe  cases,  could  pose  a  threat 
to  the  health  and  safety  of  plant  workers  and/or  the  general  public. 
Other  important  considerations  reflect  economic  factors  (repair  of 
structural  failures  in  nuclear  power  plants  involve  higher  than  normal 
costs  because  of  radiation  cone  'rns  and  extremely  high  plant  outage  and 
replacement  power  costs)  and  visibility  concerns  (there  is  a  high  level 


of  public  and  media  interest  in  any  problem  at  a  nuclear  power  plant  as 
evidenced  by  the  attention  given  the  1979  Three  Mile  Island  accident). 
Even  a  minor  incident  can  receive  much  publicity.  These  latter 
considerations,  however,  are  secondary  to  the  primary  focus  of  plant 
safety. 

Desc  r ipt ion 

In  order  to  meet  its  obiective,  the  nuclear  power  industry  has  an 
intensive  and  broad-reaching  structural  integrity  assurance  program  that 
covers  virtually  all  equipment  and  structures  in  a  power  plant.  The 
program  is  implemented  through  industry  codes  and  standards.  Their  use 
is  mandated  by  the  federal  laws  and  regulations  governing  the  licensing 
and  operation  of  commercial  nuclear  power  plants.  (By  and  large, 
overseas  operators  have  adopted  the  U.S.  codes  and  standards  or  their 
equivalent.)  The  major  documents  that  embody  the  structural  integrity 
assurance  program  for  nuclear  power  plants  are: 

1.  American  Society  of  Mechanical  Engineers  (ASME)  Boiler  and 
Pressure  Vessel  Code,  Section  III  -  Rules  for  Construction  of  Nuclear 
Power  Plant  Components; 

2.  ASME  Boiler  and  Pressure  Vessel  Code,  Section  XI,  Rules  for 
In-Service  Inspection  of  Nuclear  Power  Plant  Components;  and 

3.  Institute  of  Electrical  and  Electronics  Engineers  (IEEE)  344, 
Recommended  Practices  for  Seismic  Qualification  of  Equipment  for  Nuclear 
Power  Generating  Stations. 

The  program  includes: 

1.  Classification  of  equipment  with  respect  to  its  importance  to 
plant  safety. 

2.  Definition  of  structural  design  conditions  for  the  plant  lifetime 
(usually  40  years).  Design  conditions  include  normal  operational  loads, 
seismic  loads,  and  special  loads  resulting  from  certain  postulated 
"design  basis  accidents"  at  the  plant.  Special  seismic  testing 
requirements  are  also  specified  in  IEEE  344  for  certain  classes  of 
equipment  which,  by  their  nature,  are  not  amenable  to  analysis. 

3.  Material  selection.  ASME  Section  III  specifies  allowable 
materials  for  various  classes  of  equipment  as  well  as  the  design  strength 
and  toughness  properties  for  each.  Acceptable  welding  procedures  and 
process  controls  also  are  specified  by  code. 


4.  Design  analysis  rules.  ASME  Section  III  imposes  various  factors 
of  safety  for  specific  combinations  of  equipment  classifications  and 
loading  conditions.  The  design  rules  also  provide  for  materials  fatigue 
and  brittle  fracture  consideration. 


25 


5.  Quality  assurance  rules  that  are  imposed,  to  ensure  that  the 
above  requirements  will  be  universally  implemented.  Extensive  pedigrees 
and  paperwork  certifying  that  materials  and  process  requirements  have 
been  met  accompany  each  heat  of  material  and  each  fabricated  component. 
Various  levels  of  nondestructive  examination  are  imposed  during 
construction  with  associated  acceptance  standards  for  flaws  or  defects. 

6.  In-service  controls.  ASME  Section  XI  specifies  these  controls 
which  include  an  extensive  in-service  nondestructive  examination  program, 
periodic  pressure  testing  of  reactor  pressure  boundary  components,  and 
periodic  functional  testing  of  essential  pumps  and  valves.  As  in  design 
and  construction,  the  level  and  extent  of  in-service  controls  also  are 
geared  to  the  classification  of  the  equipment  with  respect  to  its 
importance  to  plant  safety.  Acceptance  standards  for  in-service 
inspections  are  based  on  fracture  mechanics  flaw  tolerance  considerations 
with  the  criteria  being  that  there  be  no  loss  in  the  structural  safety 
margin  for  the  original  design  basis  for  the  component. 

Benefits 

The  overriding  result  of  the  nuclear  power  industry's  structural 
integrity  assurance  program  is  that  the  basic  safety  objective  has  been 
met.  There  has  never  been  a  plant  structural  failure  that  has  had 
significant  public  health  or  safety  consequences.  Any  structural  failure 
or  material  cracking  problems  have  been  detected  early,  through 
in-service  monitoring,  and  corrective  actions  have  been  implemented  long 
before  the  problems  had  any  impact  on  structural  safety  margins. 


FRACTURE  CONTROL  IN  THE  POWER  GENERATION  INDUSTRY 
(LARGE  ROTATING  EQUIPMENT)* 


Power  generation  equipment  in  the  United  States  is  manufactured  by 
private  industry  whose  major  goal  is  profit;  therefore,  the  ultimate 
purpose  of  a  structural  integrity  program  is  an  economic  one.  Specific 
goals  are  to  reduce  structural  component  failures  that  may  cause  serious 
equipment  damage  and  safety  hazards,  to  decrease  maintenance 
requirements,  and  to  increase  the  efficiency.  These  considerations  can 
all  be  influenced  by  a  structural  integrity  program  that  attempts  to 
reduce  structural  failures  and  all  of  these  issues  are  related  to 
economics . 


Description 


The  power  generation  industry  has  long  been  aware  of  the  problems 
associated  with  the  assurance  of  structural  integrity  in  large  rotating 

♦Based  on  a  May  1983  presentation  to  the  committee  by  Dr.  John  Landes, 
Westinghouse  Research  and  Development  Center,  Pittsburgh,  Pennsylvania. 


equipment.  A  catastrophic  brittle  fracture  can  suddenly  release  millions 
of  foot-pounds  of  stored  energy  and  cause  damage  equivalent  to  the 
detonation  of  high  explosives.  Work  was  begun  in  the  late  1940s  to  try 
to  understand  the  factors  controlling  flaw  growth  and  fracture  of  metals 
(Robinson  1944).  A  series  of  catastrophic  failures  of  large,  medium 
strength,  turbine  and  generator  rotor  forgings  in  the  mid-1950s  greatly 
accelerated  this  work  (Thum  1956).  Much  of  the  work  in  the  1950s 
employed  spin  burst  tests  (Sankey  1960,  Winne  and  Wundt  1958)  of  large 
model  rotors  with  sharp  machined  notches  in  the  bore  to  evaluate 
susceptibility  to  brittle  fracture.  With  the  development  of  linear 
elastic  fracture  mechanics  (LEFM)  approaches  in  the  late  1950s  and  early 
1960s,  fatigue  precracked  specimens  were  substituted  for  notched 
specimens  (Wessel  1960,  Yukawa  and  McMullen  1961).  The  concept  of  LEFM 
Kjc  fracture  toughness  was  developed  and  a  more  convenient  laboratory 
specimen  was  substituted  for  the  spin  burst  test.  The  power  generation 
industry  has  continued  to  use  fracture  mechanics  concepts  for  structural 
integrity  procedures,  and  these  concepts  have  evolved  to  consider  cyclic 
loading,  adverse  environments,  and  plasticity  effects  in  addition  to 
brittle  fracture. 

The  structural  integrity  plans  implemented  by  the  various 
manufacturers  of  large  rotating  equipment  are  not  uniform  within  the 
industry  because  there  is  no  industry  regulatory  agency.  These  plans  are 
often  proprietary  and  the  major  components  of  a  single  power  plant  can  be 
manufactured  by  different  divisions  of  a  large  corporation  using 
different  methods  for  structural  integrity  assurance. 

Usually  the  main  burden  of  developing  and  implementing  a  structural 
integrity  plan  lies  with  the  designers  of  the  equipment.  They  must  be 
aware  of  all  elements  in  a  structural  integrity  plan  and  make  sure  that 
these  elements  are  included  in  the  design.  Very  often  the  designers  will 
rely  on  support  groups  to  cover  the  specific  elements  for  ensuring 
structural  integrity.  For  example,  a  materials  group  may  recommend  an 
optimum  material  for  an  application,  a  nondestructive  inspection  group 
may  determine  the  level  of  quality  of  materials  and  manufactured  parts, 
and  an  analysis  group  may  provide  information  on  loads  and  stresses  of  a 
component  during  usage.  Nevertheless,  it  is  the  equipment  designer  who 
must  ensure  that  all  needed  elements  are  included.  Fortunately,  most  new 
designs  are  based  on  previous  ones  and  the  designers  of  new  systems  need 
not  completely  develop  new  structural  integrity  plans  since  information 
relating  to  the  reliability  of  earlier  designs  is  used  to  develop 
procedures  that  become  part  of  a  standard  design  practice. 

Traditionally,  the  designer  has  been  largely  responsible  for  ensuring 
that  a  structural  integrity  plan  was  incorporated  in  the  design.  With 
the  increasing  importance  of  structural  integrity,  however,  new  methods 
are  being  developed  to  assist  the  designer  in  ensuring  that  the 
structural  integrity  plan  is  followed.  One  of  these  methods  is  design 
review  in  which  experts  on  all  elements  of  a  structural  integrity 
analysis  review  a  design  to  make  sure  that  nothing  is  missing  in  the 
plan.  This  is  especially  important  with  new  designs  to  ensure  that  the 
latest  technological  advances  are  included  in  the  design  and  integrity 
plan. 


Equipment  integrity  also  is  reviewed  once  the  equipment  is  placed  in 
service.  Unfortunately,  deficiencies  in  the  structural  integrity  plan 
are  sometimes  discovered  at  this  stage  and  may  require  immediate  design 
modifications.  These  modifications  can  involve  costly  field  repairs  and 
major  revamping  of  manufacturing  procedures. 

Benefits 


The  application  of  a  structural  integrity  plan  to  ensure  the  reliability 
of  large  rotating  equipment  produces  economic  benefits  for  both  the 
equipment  manufacturer  and  the  user  of  the  equipment. 

The  manufacturer  of  the  equipment  is  a  private  corporation  and  has 
profit  as  an  ultimate  goal.  Failure  of  a  piece  of  equipment  can  cause 
direct  loss  of  profit  as  a  result  of  obligations,  lawsuits  for  property 
damage,  and  compensation  required  for  loss  of  life  or  serious  injury. 
Structural  failure  also  can  result  in  an  indirect  loss  of  profit  in  that 
poor  performance  of  equipment,  safety  problems,  inefficient  operation  and 
high  maintenance  costs  can  create  a  poor  image  for  a  corporation  and 
severely  affect  sales. 

The  customer  who  purchases  and  uses  the  equipment  also  has  economic 
concerns.  Poor  performance  and  structural  failure  can  adversely  affect 
the  efficiency  of  the  customer's  operation.  Unplanned  equipment  outages 
result  not  only  in  unplanned  maintenance  costs  but  also  in  shutdown  of  a 
power  generating  unit  and,  thus,  revenue  that  would  have  been  generated 
by  that  unit  is  lost  for  the  shutdown  period  (easily  in  excess  of  $1 
million  a  week  for  a  power  unit  in  excess  of  100  MW). 

FATIGUE  ANALYSIS  PROGRAM  FOR  GROUND  VEHICLE  COMPONENTS* 

Purpose 

The  Ford  Motor  Company  has  developed  a  computerized  fatigue  analysis 
supervisory  program  (FATSUP) .  It  is  specifically  tailored  to  the  needs 
of  a  large  industrial  engineering  organization  and  provides  the  Ford 
engineering  staff  with  the  most  recent  advances  in  structural  fatigue 
methodologies. 

Description 

The  ground  vehicle  industry  uses  fatigue  analysis  in  the  following  areas: 

1.  Initial  sizing  of  prototype  components, 

2.  Design  of  production  components,  and 

3.  Revision  of  production  components. 


*Based  on  a  May  1983  presentation  to  the  committee  by  Dr.  R.  W.  Landgraf, 
Ford  Motor  Company,  Detroit,  Michigan. 
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In  initial  sizing,  the  selection  of  a  design  load  level  by  an  engineer 
determines  estimated  material,  size,  and  durability  requirements  of  the 
components.  This  initial  design  information  is  based  upon  past  history, 
handbooks,  and  supplier  material  and  durability  statistics. 


Prototypes  are  built  and  tested  both  in  the  laboratory  and  on  the 
proving  grounds  to  estimate  design  loads  for  production  components. 
Variations  in  these  tests  result  in  the  conduct  of  fatigue  life 
computations . 

The  design  of  production  components  is  continuously  revised  in  order 
to  decrease  weight  (increase  mileage  rating)  or  make  material  changes  as 
a  result  of  differences  in  proving  ground  assumptions  and  actual  customer 
experience.  Computations  for  fatigue  damage  are  made  to  determine  the 
effects  on  the  modified  component. 

The  Ford  design  and  analysis  groups  have  available,  through  FATSUP,  a 
versatile  computer  program  that  can  describe  and  manipulate  the  variety 
of  load,  stress  analysis,  and  material  property  data  required  to  perform 
the  various  fatigue  analyses  described  above.  In  reviewing  the  basic 
elements  of  a  structural  integrity  program,  FATSUP  incorporates  into  its 
data  files  the  information  from  all  five  major  program  elements 
identified  in  Chapter  2  that  are  pertinent  to  designing  components  for 
ground  vehicles.  The  program  is  not  really  directed  at  the  quality 
control  aspects  or  the  maintenance,  inspection,  and  repair  aspects. 

Benefits 


In  this  example  of  a  representative  ground  vehicle  structural  integrity 
program,  the  focus  is  on  a  single  failure  mode,  fatigue,  known  to  be  of 
special  importance  to  the  automotive  industry.  The  result  is  a  package 
of  interactive  computer  program  modules  that  enable  the  designer  to 
formulate  and  solve  a  wide  variety  of  ground  vehicle  problems  using 
state-of-the-art  approaches  to  fatigue  analysis.  The  approach  reflects  a 
philosophy  on  the  part  of  the  ground  vehicle  industry  to  design  out 
potential  fatigue  problems  before  the  prototype  goes  into  production  so 
as  to  achieve  recognition  as  producers  of  reliable,  low  maintenance 
products. 


ASSURING  STRUCTURAL  INTEGRITY  OF  OIL  PIPELINES* 

A  structural  integrity  plan  has  been  successfully  applied  to  establish 
allowable-flaw-size  limitations  in  pipeline  girth  welds.  It  was 
developed  in  1976  when  the  National  Bureau  of  Standards  (NBS)  assisted 
the  U.S.  Department  of  Transportation  (DOT)  (Reed  et  al.  1979)  in  the 


*Based  on  a  May  1983  presentation  to  the  committee  by  Dr.  Harry  McHenry, 
National  Bureau  of  Standards,  Boulder,  Colorado. 


evaluation  of  a  petition  for  a  waiver  of  American  Petroleum  Institute 
(API)  weld  quality  standards  for  certain  girth  welds  in  the  Trans-Alaska 
Pipeline  System  (TAPS). 

Purpose 

Federal  safety  regulations  for  pipelines  stipulate  that  the  acceptability 
of  girth  welds  must  be  determined  in  accordance  with  API  weld  quality 
requirements.  Allowable  flaw  sizes  for  each  of  the  characteristic  defect 
types  are  set  forth  in  API  1104  on  the  basis  of  workmanship  consider¬ 
ations  (i.e.,  flaw  size  limits  are  based  on  quality  levels  that  can 
reasonably  be  expected  from  a  qualified  welder  using  satisfactory 
materials,  equipment,  and  procedures).  In  addition,  federal  regulations 
stipulate  that  all  arc  burns  must  be  repaired.  The  quality  requirements 
are  the  same  for  all  pipelines  regardless  of  pipe  size,  strength  and 
toughness  of  pipe  and  girth  welds,  or  pipeline  operating  conditions. 

The  waiver  request  proposed  alternative  weld  quality  standards  based 
on  a  f itness-for-service  assessment  done  in  accordance  with  draft  British 
Standards  Institution  rules  (British  Standards  Institution  1976).  This 
investigation  was  subsequently  followed  by  a  DOT  decision  that  permitted 
limited  use  of  the  alternative  standards  and  set  an  important  legal 
precedent:  "Fracture  mechanics  analysis  is  acceptable  as  a  basis  for 

granting  exemptions  from  existing  standards  in  appropriate  circum¬ 
stances...."  A  subsequent  audit  of  a  statistical  sample  of  TAPS  girth 
weld  radiographs  (1500  welds)  indicated  that  7.9  percent  of  the  girth 
welds  sampled  did  not  meet  DOT  weld  quality  standards.  The  alternative 
standards  and  the  legal  precedent  provided  the  basis  for  deciding  that 
the  weld  quality  was  acceptable,  thereby  avoiding  a  potential  delay  in 
pipeline  start-up.  Additionally,  the  large  costs  associated  with  field 
repair  of  girth  welds  were  avoided. 

Alternative  allowable  flaw  sizes  for  girth  welds  in  a  specific 
pipeline  were  calculated  on  the  basis  of  fracture  mechanics  analyses  in 
accordance  with  requirements  set  forth  by  the  Office  of  Pipeline  Safety 
Operations  (OPSO)  of  DOT. 

Desc  r ipt  ion 

Critical  fLaw  sizes  were  calculated  using  four  distinct  fracture 
mechanics  analysis  methods  and  the  appropriate  maximum  credible  stress 
and  material  property  information.  The  fracture  mechanics  models  were: 

(1)  the  critical  crack  opening  displacement  (COD)  method  (Knott  1973), 

(2)  the  draft  British  rules,  (3)  the  plastic  instability  method,  and 
(4)  a  semi-empirical  method  developed  on  the  basis  of  pipe  rupture 
tests.  The  material  property  data  needed  included  fracture  toughness, 
tensile  properties,  fatigue  crack  growth  rate,  and  the  stress  corrosion 
threshold.  Minimum  material  properties  over  the  temperature  range 
represented  by  pipeline  operating  conditions  were  used. 

Alternate  allowable  flaw  size  curves  were  calculated  using  the 
applicable  fracture  mechanics  models,  material  property  data,  and 
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pipeline  operating  stresses  for  each  of  four  types  of  flaw:  blunt 
(nonplanar)  weld  flaws  such  as  porosity  and  slag,  sharp  flaws  such  as 
incomplete  penetration  and  lack  of  fusion,  arc  burns  in  the  weld  or  heat 
affected  zone,  and  arc  burns  in  the  base  metal.  The  calculated  flaw 
sizes  were  reduced  in  magnitude  by  the  safety  factors  specified  in  the 
OPSO  requirements.  The  results  were  plotted  as  alternative  allowable 
flaw  size  curves  with  flaw  depth  versus  flaw  length  (Figure  9). 

Worst-case  operating  conditions  were  used  to  assign  stress  values. 
Girth  weld  flaws  are  typically  oriented  circumferentially  and, 
consequently,  axial  stresses  (including  pressure  and  thermal  cycles  and 
earthquake  loadings  during  30-year  pipeline  lifetime)  were  used  in  the 
fracture  mechanics  analysis.  Arc  burns  were  typically  spots  or  axially 
aligned  drags  and  flaw  growth  would  be  caused  by  the  hoop  stresses 
(including  hydrotests,  pressure  surges,  and  on-off  pressure  cycles). 

Since  all  flaws  were  considered  as  surface  cracks,  the  principal 
differences  in  the  four  types  were  orientation,  location,  and  applicable 
safety  factors.  Flaw  orientation  determined  whether  the  applicable 
stresses  were  axial  or  hoop.  Flaw  location  was  used  to  establish  the 
applicable  minimum  fracture  toughness  value.  The  applicable  safety 
factors  include  a  factor  of  two  on  length  and  depth  for  all  flaws  plus  an 
additional  factor  of  two  on  estimated  depth  of  planar  flaws. 

Benefits 

There  are  strong  economic  incentives  to  apply  a  structural  integrity  plan 
to  field  welds  of  large  diameter  pipelines.  The  majority  of  girth  weld 
flaws,  whose  size  exceeds  the  API  1104  welding  workmanship  standards,  are 
blunt  flaws.  Application  of  a  structural  integrity  plan  (using  fracture 
mechanics  assessment)  permits  larger  blunt  flaws  to  remain,  thus  reducing 
the  frequency  of  very  expensive  repair  welding  in  the  field.  Addition¬ 
ally,  the  API  have  proposed  a  generic  pipeline  structural  integrity  plan 
for  addition  to  DOT  federal  regulations.  In  support  of  this,  the 
National  Bureau  of  Standards  has  been  developing  fracture  mechanics  and 
nondestructive  inspection  for  a  generic  pipeline  structural  integrity 
plan  and  for  possible  Alaska  gas  pipelines. 


STRUCTURAL  INTEGRITY  PROGRAM  FOR  AIRFRAMES* 


Another  example  of  a  structural  integrity  program  is  the  U.S.  Air  Force's 
Aircraft  Structural  Integrity  Program  (ASIP)  described  in  Military 
Standard  1530A.  This  document  defines  the  overall  requirements  necessary 
to  achieve  structural  integrity  of  USAF  airplanes  and  specifies 
acceptance  methods  of  contractor  compliance.  The  standard  is  used  by 


*Based  on  a  July  1983  presentation  to  the  committee  by  Dr.  Frank  Adams, 
Air  Force  Wright  Aeronautical  Laboratory,  Wright-Patterson  Air  Force 
Base,  Ohio. 
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9  Alternative  allowable  flaw  size  curve  for  sharp  (planar)  flaws 
in  Trans-Alaska  Pipeline  System  girth  welds  (McHenry  1979). 
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contractors  in  developing  an  airframe  for  a  particular  weapon  or  support 
system  and  by  government  personnel  in  managing  the  development, 
production,  and  operational  support  of  a  particular  airplane  system 
throughout  its  life  cycle.  It  is  directly  applicable  to  manned  power 
driven  aircraft  having  fixed  or  adjustable  fixed  wings  and  to  those 
portions  of  manned  helicopters  that  have  similar  structural 
characteristics.  Helicopter  transmission  systems  and  rotors  and  other 
dynamic  machinery  including  engines  are  not  covered  by  this  standard. 

Desc  ript ion 

Military  Standard  1530A  was  developed  in  the  early  1970s  after  the 
catastrophic  crash  of  an  F-lll  aircraft  that  had  only  100  hours  of  flight 
service.  The  cause  of  the  accident  was  an  undetected  flaw  in  the  wing 
pivot  fitting  that  resulted  in  the  loss  of  the  wing  during  flight. 

Prior  to  1970  the  Air  Force  used  a  "safe-life"  approach  to  structural 
design  to  ensure  safety  and  durability.  In  general,  the  fatigue  life  of 
the  structure  was  determined  through  testing  of  materials,  components, 
and  full-scale  airframes  and  a  safety  factor  of  four  applied  to  reduce 
the  probability  of  failure  to  an  acceptable  value.  This  approach  did  not 
explicitly  take  into  account  the  possibility  of  infrequently  occurring 
flaws  due  to  material  defects  and  manufacturing  processes.  The  F-lll 
crash  stimulated  the  Air  Force  to  adopt  a  new  design  philosophy.  The 
basic  assumptions  underlying  this  new  approach  are  that  flaws  are  present 
in  new  structures  and  that  structures  can  be  designed  such  that  cracks 
can  grow  from  these  flaws  for  a  specified  period  of  unrepaired  service 
without  structural  failure  occurring.  This  approach  is  generally 
referred  to  as  "damage-tolerant"  design. 

A  very  important  feature  of  the  Air  Force's  new  approach,  which  can 
be  applied  to  structural  design  in  an  economic  way,  is  that  damage 
tolerance  (avoidance  of  catastrophic  failure  in  flight)  and  durability 
are  decoupled.  This  was  not  the  case  with  the  safe-life  approach. 

The  current  Air  Force  structural  integrity  program  is  firmly  embedded 
in  Air  Force  regulations.  USAF  Regulation  80-13  instructs  the  system 
program  offices  (SPOs),  which  have  responsibility  for  developing  new 
aircraft  weapon  systems,  to  comply  with  Military-Standard  1330A,  USAF 
Aircraft  Structural  Integrity  Program.  This  program  has  five  tasks  that 
cover  an  airframe  from  preliminary  design  to  retirement.  Detailed 
requirements  related  to  damage  tolerance,  durability  structural  testing, 
sonic  fatigue,  etc.,  are  provided  in  a  set  of  military  specifications. 

The  applicable  regulations  are  outlined  in  Figure  10  and  the  five  tasks 
in  the  AS1P,  in  Figure  11. 

Task  l  of  the  USAF  ASIP  deals  with  design  information.  The  objective 
is  to  develop  criteria  that  must  be  applied  during  design  so  that  the 
specific  requirements  are  met.  The  first  step  is  the  development  by  the 
contractor  of  an  ASIP  Master  Plan  for  any  new  aircraft  system.  This  plan 
i  nc  l  tide  s  : 


FIGURE  14  Fiberglass-wrapped  LAW  rocket  motor  (Bruggeman  1981) 
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STRUCTURAL  INTEGRITY  ISSUES  IN  THE  ARMY 


INTRODUCTION 

This  chapter  presents  several  case  studies  of  Army  systems  that  illustrate 
how  structural  integrity  was  or  was  not  implemented  in  the  development 
process.  The  use  of  a  structural  integrity  plan  reflects  an  overt  decision 
by  the  program  manager  that  was  essential  to  the  development  of  the  system. 
When  a  structural  integrity  plan  was  not  used,  it  was  simply  taken  for 
granted,  not  intent iona 1 ly  ignored.  The  cases  considered  are  examples.  No 
attempt  was  made  to  develop  or  assess  the  full  scope  of  recent  Army 
structural  failures. 


CASE  STUDY:  THE  M72  LIGHT  ANTITANK  WEAPON  (LAW) 


The  M72  light  antitank  weapon  (LAW)  system  was  developed  in  the  early  1960s 
for  Army  and  Marine  Corps  use.  The  system  consists  of  a  self-contained 
lightweight  shoulder-fired  launcher  and  a  high  explosive  antitank  rocket. 
Major  components  of  the  launcher  and  rocket  are  identified  in  Figures  13  and 


14. 


From  very  early  in  its  history,  the  LAW  has  experienced  a  series  of 
failure  problems  in  the  rocket  closure  and  motor  body  that  resulted  in 
failure  to  perform  its  mission  and,  in  some  cases,  injury  to  personnel.  In 
the  early  1970s,  failures  occurred  in  the  rocket  closure.  Figure  13 
illustrates  the  basic  nature  of  the  failures.  This  early  problem  was 
corrected  by  strengthening  the  closure  with  a  fiberglass  overwrap.  A  second 
series  of  failures  occurred  in  the  mid-1970s.  In  this  case,  the  failures 
were  in  the  rocket  motor  body.  A  second  "fix"  of  fiberglass  wrapping  of  the 
highly  stressed  and  flaw-initiation  regions  of  the  motor  body  was  then 
implemented.  However,  failures  have  continued  to  occur  even  in  the 
fiberglass  wrapped  bodies  at  failure  rates  significantly  greater  than  those 
considered  acceptable  by  the  Army. 
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and  any  other  facet  that  the  customer  believes  essential  to  the  success  of 
the  design  and  his  product. 

As  a  final  note  to  this  chapter  some  comments  by  Robert  Heymans  of 
Martin  Marietta  Corporation  (presentation  to  the  committee,  May  18,  1983) 
are  instructive.  Although  personal,  they  reflect  one  individual's 
characterization  of  an  on-going  and  successful  structural  integrity  program 
as  : 

We  don't  do  a  good  job  of  rewarding  good  design;  over¬ 
engineering  is  seldom  recognized. 

Fracture  control  plans  are  probably  imposed  on  an 
organization  by  the  customer.  It's  overseeing,  demeaning, 
and  is  a  great  inconvenience  but  imposes  beneficial 
discipline. 

The  structural  integrity  system  is  expensive,  frustrating, 
time  consuming,  stifling,  demotivating,  dehumanizing,  but  it 
works . 
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Benefits 

The  benefits  of  a  structural  integrity  program  can  be  ranked  in  various 
categories.  Certainly  safety  is  an  important  consideration,  perhaps  ranking 
higher  than  all  others.  The  reliability  and  need  for  maintenance  affect  the 
readiness  of  the  fleet  aircraft  economics;  visibility  and  political  factors 
are  also  important  in  developing  hardware  for  government  procurement.  The 
structural  integrity  program  implemented  by  the  U.S.  Navy  for  aircraft  has 
resulted  in  remarkably  improved  reliability  and  performance. 

CONCLUDING  COMMENTS 

Several  additional  structural  integrity  programs  were  reviewed  by  the 
committee;  these  programs  were  associated  with  the  NASA  space  shuttle 
program  (McHenry  and  Rolfe  1980),  the  NASA  Titan  III  program  (May  1983 
presentation  to  the  committee  by  Mr.  Robert  Heymans ,  Martin  Marietta 
Corporation,  Denver,  Colorado),  and  the  Army  helicopter  program  (Gustafson 
1977  and  Hoffrichter  and  McCracken  1978).  The  committee  also  reviewed  both 
the  Air  Force  airframe  requirements  (July  1983  presentation  to  the  committee 
by  Dr.  Frank  Adams,  Air  Force  Wright  Aeronautical  Laboratory, 

Wr ight-Patterson  Air  Force  Base,  Ohio)  and  the  industrial  implementation  of 
these  requirements  (May  1983  presentation  to  the  committee  by 
Mr.  Richard  Circle,  Lockheed  Georgia  Company,  Marietta,  Georgia).  These 
reviews  further  illustrated  various  approaches  to  developing  failure 
prevention  programs  for  given  types  of  structures. 

The  process  of  developing  and  implementing  a  successful  structural 
integrity  program  that  incorporates  the  use  of  new  or  advanced  technology 
requires  a  substantial  commitment  by  company  and  project  management,  and 
project  engineering  organizations.  This  commitment  normally  comes  as  a 
result  of  contractual  obligations  or  economic  pressures.  Organizational 
structure  becomes  important  and  involves  project  management  that  provides 
programmatics,  cost,  schedules,  basic  requirements,  and  customer  liaison. 
Engineering  provides  staffing,  quality  of  engineering,  engineering  tools, 
and  state-of-the-art  methodology  to  the  project  management  relative  to 
design  choices. 

To  ensure  that  adequate  consideration  is  given  during  design  to 
structural  integrity,  both  internal  and  external  design  reviews  are 
conducted.  The  internal  reviews  involve  teams  of  company  structural  and 
materials  engineering  specialists  who  deal  with  problem  solving,  analysis 
procedures,  and  design  approaches  for  preventing  failures.  Typically,  the 
internal  reviews  extend  beyond  the  project  engineering  team  with  the  primary 
design  responsibility. 

When  the  industrial  organization  is  contractually  liable  for 
implementing  a  customer-required  structural  integrity  program,  the  customer 
typically  conducts  independent  reviews  of  the  design.  These  reviews  can 
involve  an  approval  cycle  for  the  structural  integrity  plan  and  its 
supporting  technology  as  well  as  in-depth  evaluations  (or  audits)  of  the 
design  capability,  qualification  test  failures,  quality  control  procedures, 
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components,  crack  growth  requirements  for  these  components,  and  the 
development  of  a  fatigue  and  fracture  control  plan  that,  when  implemented, 
will  ensure  the  development  of  a  safe  and  reliable  aircraft  structure.  For 
the  most  recent  fighter  aircraft  (F-18),  the  detailed  analysis,  test, 
manufacturing,  and  materials  processing  requirements  and  controls  were 
delineated  in  a  fatigue  and  fracture  control  plan.  This  plan  was  prepared 
by  the  contractor  with  review  and  approval  by  Navy  officials. 

For  the  F-18,  long  life  meant  20  years  for  the  average  aircraft.  This 
equated  to  the  following  in  terms  of  design  spectrum  lifetime:  flight 
hours,  6000;  ground-air-ground  cycles,  3000;  field  taxi  runs,  3300;  catapult 
launchings,  2000;  landings,  including  field,  3000;  field  carrier  landing 
passes,  3000;  arrested,  2000;  and  carrier  touch  and  go,  300. 

The  severe  design  spectrum  has  two  important  facets.  The  first  is  the 
frequency  of  maneuvering  load  factor  experiences.  The  design  spectrum  is 
tailored  to  reflect  the  expected  usage  for  the  worst-case  aircraft.  Second, 
all  load  factor  exceedances  are  assumed  to  take  place  at  "points  in  the  sky" 
critical  for  major  structural  components. 

The  F-18  fatigue  and  fracture  control  program  resulted  in  50  structural 
parts  being  classified  as  fracture  critical  and  210  parts,  as  maintenance 
critical.  Fracture  critical  parts  involved  safety  of  flight  whereas 
maintenance-critical  parts  related  to  significant  operational  or  cost 
impact.  All  critical  components  were  subjected  to  crack  growth  as  well  as 
total  life  requirements. 

The  critical  component  crack  growth  analysis  was  required  to  show  one 
design  spectrum  lifetime  from  a  0.010  in.  initial  flaw  to  critical  crack 
size  in  addition  to  two  lifetimes  prior  to  crack  initiation.  Design 
spectrum  hours  from  detectable  flaw  to  component  failure  and  maximum  initial 
flaw  size  that  would  still  result  in  one  design  spectrum  lifetime,  also  were 
determined . 

The  Navy  aircraft  structural  integrity  substantiation  requirements  place 
heavy  emphasis  on  full-scale  article  and  component  test  results.  A 
full-scale  airframe  is  subjected  to  repeated  loads  until  it  has  demonstrated 
an  endurance  of  at  least  two  design  spectrum  lifetimes.  Cracks  found  in 
structural  components  during  these  tests  are  treated  as  failures  requiring 
redesign  and  retest.  To  ensure  that  necessary  structural  changes  are 
identified  and  incorporated  with  minimum  cost  and  risk,  these  tests  are 
accomplished  as  early  in  the  program  as  possible. 

Finally,  to  provide  a  means  of  scheduling  timely  actions  to  detect 
structural  problems,  and  to  facilitate  force  management  decisions,  a  fatigue 
life  tracking  program  has  been  established  for  individual  fleet  aircraft. 
This  program  provides  the  status  of  the  individual  aircraft  fatigue  life 
expended  for  fleet  aircraft  determined  by  comparing  actual  usage  to  the  full 
scale  test  results.  This  requires  on-board  monitoring  equipment.  The  older 
fleet  aircraft  generally  were  equipped  with  counting  accelerometers  for  this 
purpose  whereas  the  newer  aircraft  probably  will  be  equipped  with 
mic  coprocessors . 


Military  Specification  E-5007  was  applied  both  by  the  Army  (Helicopter 
Command,  St.  Louis)  and  by  the  Navy  (Naval  Air  Systems  Command)  during 
the  development  programs  for  the  T700  and  F404  engines,  respectively. 
These  engines  are  considered  by  Cowie  (private  communicat ion  between  W. 
D.  Cowie,  Wright-Patterson  Air  Force  Base,  Ohio  and  J.  P.  Gallagher, 
University  of  Dayton  Research  Institute,  Ohio,  September  27,  1983)  to  be 
excellent  low  maintenance  examples  of  the  successful  application  of  the 
engine  structural  integrity  program. 


U.S.  NAVY  STRUCTURAL  INTEGRITY  PROGRAM  FOR  AIRCRAFT* 

Pu  rpose 

The  U.S.  Navy  structural  integrity  program  is  intended  to  identify  for 
both  the  Navy  and  its  contractors  the  requirements  to  be  fulfilled  to 
achieve  structural  integrity.  Some  specific  goals  of  this  structural 
integrity  program  are: 

1.  To  establish,  evaluate,  and  substantiate  the  structural  integrity 
of  the  aircraft. 

2.  To  provide  assessment  of  in-service  integrity. 

3.  To  provide  a  basis  for  logistics  and  force  planning  relative  to 
maintenance,  rotation,  and  phase-out. 

4.  To  develop  methods  for  improving  design  of  future  airplanes. 

Ultimately,  the  structural  integrity  program  must  minimize  the  incidence 
of  catastrophic  failure,  improve  the  reliability  and  readiness  of  the 
fleet  aircraft,  minimize  weight  penalties,  and  hold  the  line  on  costs. 

Desc  r ipt ion 

The  U.S.  Navy's  aircraft  structural  integrity  program  is  fundamentally 
based  on  fatigue  (safe  life)  philosophy  supplemented  by  durability  and 
damage-tolerance  requirements.  Navy  policy  requires  design  for  a  long 
life  using  a  severe  load  spectrum.  The  severe  load  spectrum  provides  for 
the  "worst-case  aircraft"  and  is  tailored  to  include  loads  that  are 
critical  for  all  major  sections  of  the  aircraft.  The  combination  of 
fatigue,  durability  and  damage-tolerance  (crack  growth),  severe  loads, 
and  long  life  requirements  provides  a  grueling  test  for  design  and 
structural  integrity  substantiation. 

To  ensure  that  the  design  and  manufacturing  processes  produce  a 
durable  and  damage-tolerant  structure,  basic  fatigue  and  fracture  control 
requirements  are  included  in  the  aircraft  detail  design  specification. 
These  requirements  will  include  criteria  for  identification  of  critical 


*Based  on  a  July  1983  presentation  to  the  committee  by  Dr.  Shih  L.  Huang 
and  Mr.  Allan  H.  Johnson,  Naval  Air  Development  Command,  Warminster, 
Pennsy lvania. 
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FIGURE  12  Engine  structural  integrity  program  (Cowie  1983) 


relied  heavily  on  "build  'em  and  bust  'em"  concepts  that  emphasized  the 
repair  of  structural  problems  identified  during  system  performance 
evaluations.  Two  major  reasons  for  the  lack  of  any  in-depth  structural 
attention  were  the  limited  understanding  of  the  usage  experienced  by  the 
structural  members  while  the  engine  was  operating  and  the  absence  of 
realistic  structural  qualification  testing. 

Description 

Like  the  Air  Force's  ASIP,  the  ENSIP  is  time-phased  to  control  structural 
integrity  actions  from  preliminary  design  through  to  system  retirement. 
The  five  ENSIP  tasks  are  outlined  in  Figure  12. 

Within  Task  I,  the  structural  design  conditions  are  established  and 
the  structural  integrity  plan  is  prepared.  Cowie  (private  communication 
between  W.  D.  Cowie,  Wright-Patterson  Air  Force  Base,  Ohio  and 
J.  P.  Gallagher,  University  of  Dayton  Research  Institute,  Ohio, 

September  27,  1983)  considers  this  task  to  be  the  most  important  since 
within  this  task,  usage  is  defined,  design  criteria  are  developed,  and 
life  requirements  are  specified.  Under  Task  II,  general  design 
conditions  for  the  structure  are  used  to  develop  the  specific  duty  cycle 
(usage  conditions)  for  individual  structural  components.  Detailed  design 
and  analysis  also  are  conducted  on  individual  components  and  the 
materials  of  construction  are  chosen,  quantified,  and  controlled. 

During  Tasks  III  and  IV,  quality  assurance  testing  is  conducted  on 
the  engine  structure  and  its  major  components.  One  distinguishing 
feature  of  the  ENSIP  is  that  it  verifies  design  and  analysis  assumptions 
and  demonstrates  that  the  structure  has  met  its  structural  performance 
objectives.  A  thorough  evaluation  of  any  design  deficiencies  also  is 
conducted.  One  important  aspect  associated  with  the  demonstration  tests 
should  be  noted:  production  decisions  are  directly  tied  to  the  schedule 
and  success  of  the  full-scale  demonstration  tests.  For  example,  one 
lifetime  of  testing  is  required  on  a  designated  full-scale  engine 
demonstration  prior  to  production  release.  The  tests  conducted  under 
Tasks  III  and  IV  provide  information  for  iterating  the  design  and 
updating  the  structural  integrity  plan  to  include  the  anticipated  impact 
of  real  or  potential  problems  on  in-service  operation. 

Task  V  covers  the  implementation  of  the  structural  integrity  plan 
during  the  production  and  operational  life  of  the  engine.  Task  V 
subtasks  include  the  final  output  of  ENSIP  which  are  production  quality 
assurance  controls  on  material,  fabrication,  processing  and  inspections 
and  in-service  controls  on  usage  monitoring  and  on  in-service 
inspections,  repairs,  and  structural  maintenance. 

Benefits 


As  the  ENSIP  has  been  evolving,  benefits  to  the  development  and 
procurement  of  more  reliable  engines  have  been  noted.  Specifically,  mean 
time  between  failures  has  been  noted  to  increase  in  the  operational 
environment  and  major  failures  have  been  decreasing.  It  should  be  noted 
that  the  early  version  of  the  ENSIP  incorporated  into  the  1973  version  of 


Co  update  life  analyses  performed  using  the  design  load  histories.  Task 
IV  also  includes  the  development  of  an  individual  airplane  tracking 
program.  Most  of  the  current  operations  aircraft  in  the  USAF  fleet  are 
tracked  to  determine  individual  differences  in  usage  that  may  affect 
structural  life.  Simple  instrumentation  such  as  counting  accelerometers 
or  pilot/engineer  log  data  are  used  for  this  purpose. 

Task  V  covers  the  force  management  activities  accomplished  by  the  Air 
Force.  This  involves  implementation  of  the  force  structural  maintenance 
plan.  Information  from  the  loads/environment  spectra  survey  is  used  to 
update  this  plan.  Data  from  the  individual  airplane  tracking  program  are 
employed  to  modify  maintenance  and  inspection  schedules  to  account  for 
individual  usage.  This  task  also  involves  the  development  and  control  of 
all  maintenance  records. 

Benef its 


The  basic  objectives  of  the  USAF  ASIP  are  being  met.  Structural  failures 
due  to  fracture  are  involved  in  less  than  1  percent  of  the  total 
accidents  reported  by  the  Air  Force  (see  Table  1).  The  ASIP  pays 
particular  attention  to  obtaining  a  specified  level  of  damage  tolerance 
in  flight-critical  structures  in  order  to  ensure  safety.  This  is  of 
significant  importance  in  modern  high  performance  aircraft  where  high 
strength  materials  are  often  required.  The  c rad le-to-grave  application 
of  the  ASIP  provides  opportunities  to  lower  life-cycle  costs  by 
preventing  structural  integrity  problems  rather  than  by  "fixing"  through 
redesign  or  repair. 


STRUCTURAL  INTEGRITY  PROGRAM  FOR  AIRCRAFT  GAS  TURBINE  ENGINES* 
Purpose 


The  purpose  of  the  current  Air  Force  structural  integrity  program  for 
aircraft  turbine  engine  structures  is  to  improve  the  reliability  (for 
increased  readiness)  of  new  designs  at  lower  cost  and  to  minimize  the 
potential  for  catastrophic  failures  (Cowie  1975  and  1983,  Tiffany  and 
Cowie  1978).  This  program  has  evolved  over  the  past  15  years  to  the 
point  where  structural  performance  specifications  were  incorporated  into 
the  1973  revision  of  Military  Specification  E-5007  (a  tri-services 
specification  covering  aircraft  engines)  and  a  formal  Engine  Structural 
Integrity  Program  (ENSIP)  was  written  and  completed  in  1978.  In  early 
1983,  a  mil-prime  standard  was  sent  to  the  specifications  office  for 
publishing  (Mil-Prime  Standard  on  Turbine  Engine  Structural  Integrity 
Program)  and  contains  all  requirements  published  in  1978. 

Traditional  approaches  to  turbine  engine  design  emphasized  system 
performance  criteria  (e.g.,  high  thrust  to  weight  ratios)  at  the  expense 
of  structural  performance  criteria  (e.g.,  high  resistance  to  damage  from 
thermal-mechanical  loadings).  Early  procurement  development  programs 


*Based  in  part  on  a  May  1983  presentation  to  the  committee  by 
Mr.  Anton  Coles,  Aircraft  Engine  Business  Group,  General  Electric  Co., 
Cincinnati,  Ohio. 
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1.  Time-phased  scheduling, 

2.  Task  integration, 

3.  Unique  features, 

4.  Anticipated  problems,  and 

5.  Impact  of  delays — recovery  plans. 

It  is  updated  annually  or  when  important  changes  occur  and  must  be 
approved  by  the  Air  Force.  The  contractor  also  must  establish  structural 
design  criteria.  These  must  be  in  concert  with  the  applicable  military 
specifications. 

Task  I  also  deals  with  the  development  of  damage-tolerance  and 
durability  control  plans.  In  these  plans,  fracture-critical  and 
durability-critical  parts  are  identified.  Drawings  showing  critical 
locations  are  developed.  Also  documented  are  the  basic  fracture  data  to 
be  used,  quality  control  procedures,  inspection  techniques,  test 
procedures,  material  processing  specifications,  and  joining  methods.  All 
of  the  subtasks  in  Task  I  are  performed  taking  into  account  the  design 
service  life  and  design  usage  specified  by  the  Air  Force. 

Task  II  deals  with  design  analysis  and  developmental  tests.  Material 
and  joint  allowables  are  developed.  Load  analyses  are  performed  to 
obtain  the  design  load  spectra  (load  histories).  Thermal  and  chemical 
environments  are  considered.  This  task  also  includes  the  stress  analysis 
work.  In  addition,  fracture  mechanics  life  analyses  are  required  for 
each  structure  on  the  fracture  critical  parts  list.  Life  analyses  are 
performed  on  durability  critical  parts.  Other  analyses  include  sonic 
fatigue,  vibration,  flutter,  nuclear  weapon,  and  non-nuclear  weapon 
effects.  Developmental  testing  to  verify  all  of  these  analyses  is 
performed  under  Task  II. 

Task  III  involves  full-scale  testing  of  the  structure.  This  includes 
static  strength  tests  of  the  full  airframe  and/or  selected  components. 
Cyclic  durability  (fatigue)  tests  also  are  performed.  Damage  tolerance 
testing  is  accomplished  on  structures  in  which  flaws  have  been  introduced 
at  critical  locations.  Sonic  fatigue,  vibration  and  flutter  testing  are 
performed  when  appropriate.  The  basic  objective  of  all  full-scale 
testing  is  to  verify  analyses  performed  during  Task  II.  This  is  markedly 
different  from  what  occurred  under  the  pre-1970  safe-life  approach  which 
used  full-scale  testing  to  determine  the  structural  life. 

Tasks  IV  and  V  involve  "force  management"  which  is  the  terra  the  USAF 
employs  to  refer  to  the  assurance  of  structural  integrity  after  the 
aircraft  is  operational.  Task  IV  is  performed  by  the  contractor  while 
Task  V  is  accomplished  by  the  Air  Force. 

In  Task  IV  the  contractor  is  required  to  develop  a  "force  structural 
maintenance  plan."  This  is  the  "owners  manual"  and  provides  plans  for 
the  specific  actions  needed  during  the  service  life.  Cost  factors  also 
are  developed  during  this  task.  Another  part  of  Task  IV  is  the 
development  of  the  plans  and  data  package  required  to  perform  a 
" load /envi ronment  spectra  survey."  This  involves  instrumenting  a  portion 
of  the  fleet  to  measure  actual  load  histories.  These  data  are  later  used 
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FIGURE  11  USAF 


FIGURE  10  USAF  Aircraft  structural  integrity  program. 


Detailed  failure  investigations  have  indicated  that  the  primary  cause 
of  the  failures  was  the  unusually  low  fracture  toughness  of  the  high 
strength  aluminum  alloy  7001-T6  of  which  the  rocket  motor  and  closures 
were  fabricated  (average  toughness  on  the  order  of  10  ksi  /in.  with 
measured  values  as  low  as  7  ksi  /in. ) .  The  problem  was  aggravated  by  the 
susceptabi lity  of  the  material  to  stress  corrosion  cracking,  which 
produced  enlarged  flaw  sites.  The  occurrence  of  different  failures  rates 
among  LAW  systems  from  different  manufacturers  was  investigated,  but  only 
subtle  differences  in  manufacturing  processes  were  observed.  It  was 
concluded  that  the  problem  was  basically  one  of  poor  material  selection 
rather  than  one  of  poor  manufacturing  or  quality  control. 

Possible  Effects  of  a  Structural  Integrity  Plan 

Had  a  structural  integrity  program  like  that  outlined  in  Chapter  2  been 
in  place  during  the  development  of  the  LAW  system,  the  first  step  would 
have  been  to  identify  components  critical  to  life  and  mission,  which 
would  have  clearly  included  the  rocket  motor  and  closure  components. 
Identification  of  design  loads  and  environment  would  have  been  similar  to 
the  procedure  actually  used,  but  an  additional  step  of  assuming  some 
damage  to  be  present  would  have  been  included  as  input  to  the  design 
analysis.  This  may  have  identified  the  stress  corrosion  mechanism,  with 
some  controls  on  levels  of  residual  stress  or  crack  propagation  rate.  As 
a  minimum,  a  design  basis  flaw  would  have  been  assumed,  and  fracture 
mechanics  calculations  performed  to  determine  minimum  acceptable  material 
fracture  toughness.  Fracture  toughness  measurements  would  then  have  been 
part  of  the  material  selection  process,  and  it  is  likely  that  aluminum 
alloy  7001-T6  would  have  been  shown  to  be  unacceptable  for  the  intended 
usage.  If  an  acceptable  alternative  material  could  not  be  identified, 
compromises  would  have  been  made,  in  terms  of  either  increased  weight  or 
reduced  performance  requirements  to  reduce  stress.’  Finally,  even  if  the 

above  changes  were  not  implemented  during  intial  design,  improved 
in-service  structural  integrity  controls  might  have  provided  better 
feedback  from  the  initial  series  of  structural  failures  such  that  more 
effective  "fixes"  could  have  been  implemented  in  later  production  runs. 


CASE  STUDY:  M60  TAKK 


Until  sufficient  quantities  of  the  Ml  (Abrams)  tank  are  produced  the  Army 
will  continue  to  rely  on  the  M60,  developed  in  the  1960s,  as  its 
principal  heavy  tank.  To  increase  the  effectiveness  of  the  M60  during 
this  interim  period,  the  Army  has  undertaken  a  major  "rebuild"  program. 

In  December  1981,  the  M60  program  manager  expressed  concern  about  the 
reliability  of  various  components  of  overhauled  tanks  as  a  result  of 
failures  exoerienced  during  proving  ground  tests.  In  response  to  that 
concern,  one  of  the  Army  laboratories  formed  an  interdisciplinary  task 
group  consisting  of  specialists  in  materials  science,  engineering, 
structural  mechanics,  nondestructive  testing,  and  statistical  analysis. 
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This  group  was  chartered  to  evolve  life  prediction  methodology  for 
application  to  a  structural  component  of  the  M60  tank.  The  torsion  bar 
was  chosen  for  the  application  because  failure  of  bars  was  of  concern  and 
because  a  fairly  comprehensive  history  was  available. 

Failure  of  a  torsion  bar  in  an  M60  tank  does  not  generally  result  in 
an  accident  that  threatens  life;  however,  if  a  failure  occurs  during  a 
dangerous  maneuver,  the  ensuing  accident  couldl  Most  often,  torsion  bar 
failure  results  in  reduction  of  mobility  that,  in  turn,  affects  the 
mission  success.  Furthermore,  even  if  mobility  is  only  reduced  and  not 
lost,  the  failure  of  a  bar  results  in  other  bars  being  loaded  beyond 
design  limits,  thereby  accelerating  total  loss  of  mobility.  Exacerbating 
the  situation  is  the  Army  M60  maintenance  policy;  bars  are  simply 
replaced  at  fixed  intervals  and  no  records  of  individual  torsion  bar 
service  history  are  kept. 

Given  the  unsatisfactory  failure  history  of  the  M60,  the  program 
manager  wished  to  "develop  a  position  with  regard  to  durability  of 
reconditioned  vehicles,  and  feasibility  of  predictive  testing  as  part  of 
the  overhaul  process."  In  effect,  the  goal  was  to  implement  a  structural 
integrity  program. 

With  this  background  the  Army  laboratory's  task  group  undertook  the 
assignment  of  developing  a  life  prediction  methodology  for  assuring  the 
structural  integrity  of  the  M60  torsion  bar.  Information  and  data  were 
collected  from  the  U.S.  Army  Tank-Automotive  Command,  Anniston  Army 
Depot,  Army  Systems  Analysis  activity,  Aberdeen  Proving  Ground,  and 
relevant  contractors.  These  included  failure  data,  failed  torsion  bar 
tests,  fatigue  data,  quality  assurance  procedures  and  load  spectra. 

The  approach  taken  by  the  task  group  involved  materials 
characterization,  stress  analyses,  probabilistic  design  studies, 
sensitivity  analyses,  and  analysis  of  failed  components.  It  was  found 
that  failures  inevitably  were  initiated  within  the  splines  at  the  ends  of 
the  bar,  even  though  the  final  fracture  surfaces  extended  into  the  body. 

The  characterization  of  the  torsion  bar  material  was  quite  extensive 
and  included  chemical  analysis,  light  microscopy,  analysis  of  retained 
austenite,  hardness  traverse,  tensile  properties,  Charpy  properties,  and 
fracture  toughness  properties.  The  initial  intent  was  to  use  fracture 
mechanics  analysis  and  knowledge  of  the  fracture  toughness  of  the 
material  to  determine  an  allowable  flaw  size  that  could  be  used  during 
depot  or  unit  level  maintenance  to  decide  whether  or  not  to  replace  a 
torsion  bar. 

It  was  quickly  determined  by  the  task  group  that  inspection  for  an 
allowable  flaw  was  not  a  feasible  approach  for  the  torsion  bar.  The  bulk 
of  the  life  of  a  bar  involves  the  coalescence  of  microcracks  into  a 
macrocrack.  The  analysis  indicated  that  cracks  as  small  as  0.005  inches 
would  propagate  to  final  fracture  in  about  15  miles  of  travel.  Since 
reliable  detection  of  flaws  that  small  is  not  possible  even  under 
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controlled  laboratory  conditions  and  since  scheduled  maintenance  is  not 
carried  out  every  15  miles,  an  alternative  approach  had  to  be  pursued. 

The  alternative  approach  consisted  of  statistically  analyzing  the 
extremely  comprehensive  fatigue  data  generated  by  torsion  bar 
manufacturers  in  conjunction  with  load  spectra  information  and  making 
probabilistic  life  predictions.  Using  this  approach,  the  life  of  a 
torsion  bar  was  predicted  to  be  292  miles  with  99  percent  probability 
(i.e.,  on  the  average,  only  1  bar  out  of  100  would  fail  before  292 
miles).  The  prediction  was  consistent  with  actual  failure  information 
from  Aberdeen  Proving  Ground,  which  showed  a  99  percent  survivability  of 
262  miles. 

A  number  of  sensitivity  analyses  were  carried  out.  These  addressed 
such  questions  as  the  effects  on  life  of  various  material  properties, 
stresses  in  the  torsion  bar,  etc.  For  example,  by  redesigning  the  bar  to 
reduce  the  stress  level  by  20  percent,  a  fourfold  increase  in  life  can  be 
obtained  (Figure  16).  On  the  other  hand,  increasing  material  properties, 
such  as  fracture  toughness,  resulted  in  only  marginal  improvements 
(Figure  17). 


Probability  of  Survival  vs  Miles 


FIGURE  16  Life  of  tank  torsion  bars  as  a  function  of  stress  (Neal, 
Matthews,  and  DeAngelis  1983). 
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FIGURE  17  Influence  of  material  improvement  on  service  life  (Neal, 
Matthews,  and  DeAngelis  1983). 


One  interesting  problem  faced  by  the  task  group  involved  obtaining 
load  spectrum  information.  No  load  spectra  for  the  M60  could  be  found 
and  it  was  necessary  to  adapt  load  spectra  that  were  available  for  the 
new  Abrams  tank.  The  gross  weight  of  the  tanks  is  not  identical  and  the 
wheel-suspension  characteristics  are  different.  However,  an  engineering 
analysis  to  approximate  the  M60  spectra  was  considered  satisfactory  since 
the  spectral  data  were  skewed  toward  higher  loads — that  is  the  bulk  of 
the  load  was  not  highly  variable.  The  conclusion  was  borne  out  by  the 
good  agreement  between  the  predicted  survival  estimate  and  proving  ground 
results. 


Possible  Effects  of  a  Structural  Integrity  Plan 
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could  have  been  designed  so  Chat  an  allowable  flaw  approach  for  torsion 
bar  replacement  would  have  been  feasible.  It  is  more  likely  that 
trade-off  studies  would  have  been  made  of  operating  stress  and  materials 
selection  with  the  associated  costs  and  weight  implications  related  to 
the  probabilistic  estimate  of  life  (with  the  associated  logistics  and 
maintenance  implications). 

After  the  fact,  the  implementation  of  structural  integrity  offers  far 
less  flexibility.  The  options  are: 

1.  To  replace  bars  only  after  they  fail.  Although  this  may  be  an 
acceptable  option  in  peacetime  (i.e.,  training)  operations,  it  would  be 
risky  in  wartime  conditions.  Since  there  are  12  torsion  bars  on  the  M60, 
after  500  miles  there  is  about  a  30  percent  probability  that  on  a  given 
tank  all  bars  will  have  survived.  However,  with  another  100  miles  of 
service  the  likelihood  of  a  bar  failing  is  now  one  out  of  two;  after  200 
miles,  three  out  of  four! 

2.  To  replace  all  bars  on  a  scheduled  basis.  The  schedule  would  be 
based  on  a  trade-off  between  desired  (probabilistic)  availability  of  the 
M60  with  the  logistics  costs  of  replacement  at  various  scheduled  mileage 
accumulation.  The  problem  here  is  one  of  scheduling  replacement  to  be 
compatible  with  existing  scheduled  maintenance  requirements  for  the 
myriad  of  other  components. 

3.  Replace  bars  selectively  on  a  scheduled  basis.  This  implies  that 
maintenance  records  be  kept  on  all  bars.  Specifically,  if  a  bar  is 
replaced  because  of  failure,  the  replacement  bar's  probabilistic  life 
estimate  would  be  factored  into  the  next  scheduled  maintenance.  This 
would  require  maintaining  records  of  nonscheduled  replacement  of  bars. 
Manual  records  would  be  expensive  and  of  questionnable  reliability. 
Application  of  sensors  on  individual  bars  and/or  on-board  microprocessors 
for  data  accumulation  could  be  quite  cost-intensive. 

U.  To  redesign  to  adjust  (probabilistic)  life  with  overall 
maintenance  schedules.  Redesigning  after  the  fact  inevitably  creates 
many  problems,  most  of  which  result  directly  in  increased  costs. 

Trade-off  studies  have  not  been  performed  to  quantify  these  costs. 

The  substance  of  what  has  been  discussed  has  been  directed  to  only 
one  component  of  the  M60  tank.  There  are  many  other  structural  elements 
of  the  system  that  contribute  to  the  overall  structural  integrity  of  the 
M60  tank.  Even  restricting  attention  to  the  track  and  suspension 
subsystem,  there  are  numerous  other  issues,  such  as  track-pads  and  track- 
pins.  The  problems  with  these  other  components  are  analogous  to  those 
with  the  torsion  bar.  In  the  case  of  the  (rubber)  track-pad, 
specifications  for  the  material  are  not  sufficiently  spelled  out.  In  the 
case  of  track-pins  (which  connect  individual  track  segments)  the 
situation  is  analogous  to  the  torsion  bar;  it  is  impossible  to  detect 
allowable  flaws  in  the  pins. 

A  system-wide  structural  integrity  program  for  the  M60  would  have 
provided  the  Army  with  the  means  for  making  cost-effective  decisions 
during  the  development  of  this  vehicle. 


CASE  STUDY:  COPPERHEAD 


History 

Copperhead  is  a  cannon  launched  guided  projectile  (CLGP)  fired  from  a 
155-mm  cannon.  It  is  manufactured  for  the  Army  by  Martin  Marietta 
Corporation.  During  test  firings  the  control  section  (Figure  18)  failed 
on  some  of  the  projectiles.  The  control  section  was  produced  from  a  4340 
steel  with  a  specified  hardness  of  Rc  52-55;  the  corresponding  yield 
strength  is  approximately  250  ksi.  Martin  Marietta  believed  that  the 
high  material  strength  requirement  was  necessary  to  meet  the  high 
operational  stress  requirements.  However,  higher  strength  also  means 
lower  toughness  and  the  failures  appeared  as  a  result  of  inadequate 
toughness  in  the  presence  of  defects. 


FIGURE  18  CLGP  structural  configuration  (Bluhm  and  Freese  1978). 

Personnel  from  the  Army  Materials  and  Mechanics  Research  Center 
(AMMRC)  used  fracture  mechanics  principles  to  estimate  a  critical  defect 
size.  Based  on  an  estimated  minimum  Kjc  of  30  ksi  /in.  and  200  ksi 
operating  stress,  a  defect  size  of  0.01  in.  by  0.03  in.  would  be 
critical.  A  program  to  develop  nondestructive  testing  (NDT)  procedures 
for  detecting  these  defects  was  suggested,  but  many  felt  that  it  would  be 
impossible  to  detect  such  small  defects  with  any  regularity.  Other 
complicating  factors  were  that  neither  the  exact  toughness  of  4340  steel 
nor  the  correct  stress  requirements  were  known  very  well. 

Possible  Effects  of  a  Structural  Integrity  Plan 

A  structural  integrity  plan  based  on  fracture  mechanics  principles  could 
have  greatly  helped  to  avoid  the  firing  test  failures  and  to  minimize  the 
possibility  of  field  failures.  A  schematic  of  the  fracture  mechanics 
approach  is  shown  in  Figure  19.  Three  elements  are  required;  stress 
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FIGURE  19  Areas  of  information  required  in  the  utilization  of  fracture 
mechanics  technology. 


analysis,  defect  sizes,  and  material  properties.  A  structural  integrity 
plan  would  consider  these  three  elements  and  make  compromises  to  arrive 
at  a  design  for  the  control  section  that  would  have  a  margin  against 
failure. 

The  material  strength  level  was  specified  to  insure  a  margin  against 
plastic  overload  of  the  control  section.  This  was  based  on  an  estimated 
stress  analysis  rather  than  an  exact  one.  The  maximum  stress 
requirements  should  be  known  before  the  material  strength  level  is 
specified.  The  failures  experienced  in  test  were  from  inadequate 
toughness  rather  than  plastic  overload.  Strength  and  toughness  are 
inversely  related  in  a  4340  steel.  If  toughness  is  inadequate,  strength 
requirements  must  be  reduced.  With  an  accurate  stress  analysis,  these 
compromises  can  be  made  rationally. 

To  make  a  full  analysis  of  the  design,  NOT  inspection  capabilities 
must  be  considered.  Critical  defect  sizes  of  0.01  in.  cannot  be  found 
repeatedly.  A  more  reasonable  inspection  limit  must  be  proposed.  This 
could  be  a  starting  point  for  the  fracture  mechanics  evaluation.  The 
approach  taken  could  then  be  as  follows:  Given  a  maximum  defect  size 
that  might  be  missed  by  inspection  and  the  required  design  stress,  a 
required  toughness  level  can  be  determined.  A  small  materials  test 
program  could  be  initiated  to  determine  toughness  versus  strength  for 
this  material.  These  results  would  identify  the  maximum  strength  level 
of  the  material  that  can  still  meet  the  toughness  requirements  (obviously 


the  250  ksi  strength  is  too  high  to  give  the  needed  toughness).  If  it 
turns  out  that  this  strength  level  is  inadequate  to  meet  the  stress 
requirements  (danger  of  plastic  overload),  some  further  compromise  is 
needed  (e.g.,  the  design  must  be  modified  to  lower  the  stresses  or  a  new 
material  must  be  substituted  to  meet  both  the  required  strength  and 
toughness  levels). 

The  procedure  needed  to  implement  this  structural  integrity  approach 
is  well  established  and  known  to  guarantee  structural  reliability.  It 
must  be  implemented  based  on  a  knowledge  of  all  three  factors  in  the 
fracture  mechanics  approach  (Figure  19).  Stress  analysis  must  be 
conducted  to  get  accurate  stress  requirements.  Material  properties  must 
be  determined  through  a  test  program  rather  than  estimated  from  the 
literature.  A  realistic  inspection  limit  must  be  established;  this 
depends  on  the  facilities  and  the  accessibility  of  critical  areas  on  the 
structure.  Finally,  if  the  structural  integrity  analysis  shows  that 
failures  are  possible,  compromises  muc *.  be  made  in  the  design  or  material 
selection  for  the  component.  Putting  this  effort  into  the  initial  design 
and  evaluation  could  be  very  cost-effective  by  reducing  or  eliminating 
failures.  Repeated  failures  could  require  a  redesign  and  possible 
scrapping  of  manufactured  components.  The  end  result  could  be  orders  of 
magnitude  more  expensive  than  a  simple  structural  integrity  plan 
implemented  in  a  timely  manner. 


CASE  STUDY:  NUCLEAR  SHELL 
History 

Failure  of  the  JFF-1  engineering  development  test  (EDT)  projectile  during 
test  firings  in  December  1976  appeared  to  result  because  the  threaded 
joint  between  the  rocket  motor  and  the  bulkhead  of  the  XM-753  projectile 
did  not  hold  together.  Therefore,  the  joint  between  the  rocket  motor  and 
the  bulkhead  of  the  projectile  had  to  be  redesigned.  The  successful 
solution  of  the  joint  problem  was  developed  through  the  combined  efforts 
of  the  Army  Armament  Research  and  Development  Command  (ARRADCOM),  Sandia 
Livermore  Laboratories,  and  the  Army  Materials  and  Mechanics  Research 
Center  (AMMRC).  The  new  joint  design  used  a  total  of  16  pins  held  in 
place  by  snap  rings  (Figure  20). 

Effects  of  a  Structural  Integrity  Program 

The  AMMRC  was  assigned  the  task  of  verifying  the  structural  integrity 
of  the  new  joint  design  based  on  the  requirements  of  the  ARRADCOM 
configuration  manager.  These  design  requirements  for  structural 
integrity  included: 

1.  Peak  set-back  and  torque  at  10,400  g,  under  impulsive  torque 
resulting  from  free  run  and  under  negative  set-back  (elastic  release)  at 
barrel  exit. 

2.  Pin  retention  under  centrifugal  force  at  barrel  exit. 


3. 


Gas  pressure  of  3000  psi  at  rocket-motor-on  condition 


4.  Equal  bending  stiffness  of  the  threaded  joint. 

5.  Pin  extraction  and  joint  disassembly  and  reassembly  without 
damage  to  components. 

6.  Control  of  pin  interferences  and  bulging  effect  on  seal 
surfaces . 

7.  A  reliable  propellant  gas  seal  at  the  joint. 

The  design  effort  utilized  finite  element  analysis,  photoelastic 
analysis,  and  firing  tests  of  the  bulkhead-to-structural  case  joint  and 
analyses  and  tests  specifically  developed  for  evaluation  of  possible  pin 
joints.  The  results  of  the  analytical  analyses  were  verified  by 
experimental  tests  to  ensure  that  the  results  were  reasonable.  The  study 
went  beyond  the  normal  structural  analysis  and  evaluated  the  overall 
reliability  of  the  pin  joint  between  the  rocket  and  the  bulkhead  of  the 
pro jec t i le . 

In  reviewing  a  new  projectile  design,  there  are  a  number  of  groups 
which  must  interact  in  order  to  develop  a  functional  yet  reliable 
projectile.  The  design  drawing  for  the  proposed  projectile  comes  from 
ARRADCOM  along  with  the  design  specifications  that  the  configuration 
manager  deems  needed.  These  may  include  maintenance  requirements, 
interchangeability  of  parts,  range  and  protectory,  payload,  classified 
requirements,  and  launch  conditions.  The  Department  of  Energy  prepares 
the  physics  calculations  to  ensure  that  the  design  can  carry  the  required 
payload. 

AMMRC  is  tasked  with  defending  the  structural  reliability  of  the 
design  before  the  ARRADCOM  Nuclear  Weapons  Safety  Committee.  In  order  to 
properly  defend  the  design,  the  AMMRC  does  a  complete  stress  analysis  of 
the  design. 

Three  dimensional  analyses  are  conducted  on  the  design  and  critical 
parts  identified.  The  analysis  will  not  only  include  mathematical 
calculations  but  also  experimental  testing  of  hardware  to  verify  initial 
analytical  results.  Efforts  are  made  to  identify  other  materials  that 
would  be  more  appropriate  to  the  design  specifications.  Criteria  used 
during  this  evaluation  might  include:  yield  strength,  brittle  fracture, 
buckling  modes.  All  of  this  activity  is  directed  at  maintaining  the 
structural  reliability  of  the  projectile.  Other  failure  modes  also  might 
be  identified  during  these  activities  and  will  be  communicated  to  the 
configuration  manager  for  his  consideration.  AMMRC  will  provide  critical 
quality  assurance  criteria  based  upon  the  preliminary  design  of  the 
projectile  in  order  to  maintain  the  reliability  of  the  structure.  These 
criteria  would  assist  in  establishing  the  limits  on  the  contractor's 
manufacturing  processes  and  specifications  for  the  materials  used. 
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Throughout  this  process  of  developing  a  new  projectile,  it  is 
apparent  that  the  configuration  manager  must  believe  that  the  activities 
of  AMMRC  on  the  project  serve  his  interests.  This  type  of  cooperation  is 
created  when  all  parties  involved  are  willing  to  listen  to  the  others' 
concerns  and  to  compromise  on  design  specifications  in  order  to  develop  a 
functional  and  yet  structurally  reliable  projectile. 

COMMENTS  ON  ARMY  ACQUISITION  PRACTICES 

Within  the  U.S.  Army  material  development  and  acquisition  process, 
project  managers  are  tssigned  responsibility  for  managing  that  activity 
under  specific  charters  approved  by  the  Secretary  of  the  Army.  Unless 
specifically  addressed  by  charter,  there  is  no  formal  procedure  for 
mandating  the  implementation  of  structural  integrity  plans. 

Consequently,  structural  integrity  assurance  is  a  matter  most  often  left 
to  the  judgment  of  the  individual  project  manager.  As  the  case  studies 
presented  in  the  preceding  pages  indicate;  a  well  planned,  comprehensive 
structural  integrity  program  has  been  implemented  in  some  instances  and 
not  in  others. 

As  in  industry  and  the  other  services,  the  Army  project  manager  is 
faced  with  the  conflicting  demands  of  cost,  schedule,  performance,  and 
reliability.  Up  to  any  three  of  these  attributes  can  be  established 
explicitly  but  the  fourth  will  seek  its  own  level  (Coutinho  1977). 

Within  the  Army  system  the  typical  project  manager  is  assigned  for  about 
three  years  and  then  is  reassigned.  Hence,  cost  and  schedule  become  the 
drivers  in  the  acquisition  process  since  these  are  attributes  that  can  be 
measured  readily  and  are  used  in  evaluating  the  project  managers' 
performance.  It  is  little  wonder  that  structural  integrity  is  not  always 
explicitly  factored  into  the  development  process  and  is  not  the  most 
important  issue  to  the  project  manager  since  the  odds  are  high  that  it 
will  not  become  a  problem  during  his  tenure. 

Furthermore,  in  the  development  of  modern  systems,  high  technology 
often  becomes  the  focus  for  management  of  the  development.  Materials  and 
structures  technologies  are  often  taken  for  granted  and  languish  in  the 
background  until  a  problem  arises.  When  a  structural  integrity  (or 
structural  reliability)  problem  does  arise,  the  options  for  solving  it 
are  constrained  because  the  design  is  so  far  down  the  road.  The  result 
is  that  the  solutions  are  not  optimal  and  generally  have  an  adverse 
impact  on  the  other  attributes. 

For  example,  life-cycle  cost  will  suffer  when  an  after-the-fact 
structural  integrity  solution  is  implemented.  The  schedule  is  certainly 
delayed  by  an  unanticipated  structural  failure.  Because  an  optimal 
solution  is  not  possible,  performance  often  suffers. 

Although  the  Army  has  the  technical  capability  to  deal  with  most  of 
these  problems  through  competent  laboratory  staff,  there  is  no  mandated 
requirement  for  the  project  manager  or  his  staff  to  avail  themselves  of 
such  resources.  Further,  although  industrial  suppliers  may  apply 
structural  integrity  concepts  in  producing  products  for  sale  under  their 


own  name,  there  is  no  requirement  that  such  practices  be  used  in 
supplying  equipment  for  the  Army. 

The  problem,  then,  would  appear  to  be  the  lack  of  a  structural 
integrity  program  that  is  institutionalized  in  the  Army  acquisition 
system.  For  example,  the  Air  Force  structural  integrity  program  is 
firmly  embodied  in  Air  Force  regulations  to  cover  "cradle  to  grave" 
airframes  procurement,  but  no  such  program  is  in  place  in  the  Army. 
Although  some  project  managers  may  introduce  some  structural  integrity 
controls,  the  system  has  not  been  formalized.  Until  such  procedures  are 
introduced,  there  is  no  guarantee  that  the  problems  of  failures, 
excessive  costs,  and  fatalities  arising  from  present  practices  cause  will 
disappear. 
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PROPOSED  STRUCTURAL  INTEGRITY  PROGRAM  FOR  THE  ARMY 


REGULATION 

The  case  studies  presented  in  the  preceding  chapter  illustrate  a  need  for 
the  Army  to  institutionalize  structural  integrity.  It  is  recommended 
that  the  Army  develop  a  formal  procedure  that  requires  the  consideration 
and  implementation  of  a  structural  integrity  program.  This  procedure 
should  be  mandated  by  the  Department  of  the  Army  and  incorporated  into 
the  Army  regulations.  The  intent  is  to  ensure  that  program  managers 
recognize  their  responsibility  for  structural  integrity  and  that  explicit 
consideration  be  given  to  this  aspect  early  in  the  concept  definition 
phase.  The  intent  of  the  regulation  should  be  to  lower  the  probability 
of  discovering  costly  structural  integrity  problems  late  in  the 
development  cycle  or  after  the  system  has  been  deployed. 

SCOPE  OF  COVERAGE 

The  Army  produces  and  procures  a  large  variety  of  equipment  and  systems 
with  widely  differing  structural  reliability  consequences.  Therefore,  a 
unique  structural  integrity  plan  should  be  prepared  for  each  system 
acquisition  considering  its  specific  application  and  the  consequences  of 
structural  failures  within  that  system  in  terms  of  human  life,  mission 
success,  and  economics.  The  results  could  range  from  a  highly  detailed 
and  comprehensive  plan  for  fracture  critical  systems  or  components  to 
minimal  plans  for  components  deemed  by  the  project  team  to  be  of  small 
consequence  or  not  fracture  critical.  In  extreme  cases,  a  structural 
integrity  plan  may  be  waived  entirely,  but  this  should  involve  a 
conscious  decision  to  do  so. 

Given  the  flexibility  permitted  by  this  recommendation,  the  committee 
is  strongly  of  the  opinion  that  a  knowledgeable  organization  outside 
project  management  should  be  assigned  review  and  approval  responsibility, 
including  review  and  approval  of  decisions  to  waive  development  of  a 
structural  integrity  plan. 
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Thus,  structural  integrity  plans  would  become  a  key  element  of  the 
procurement  or  production  process  for  the  system  and  would  be  included  in 
relevant  contracts  and  specifications.  Major  considerations  in  the 
preparation  of  such  plans  should  be  developed  and  documented  in  a  generic 
military  standard  (Army  Structural  Integrity  Program)  as  described  in  the 
to  1  lowing  pages  . 

MILITARY  STANDARD 

recommended  Army  regulation  should  refer  to  a  new  military  standard 
fnat  defines  a  structural  integrity  program  considered  generic  for  all 
Army  equipment.  This  generic  structural  integrity  program  should  be 
developed  to  include  structural  design  conditions,  materials  and 
processing  controls,  design  and  analysis  controls,  quality  assurance 
controls,  and  in-service  controls.  In  developing  this  new  military 
standard,  the  Army  should  define  how  its  structural  integrity  program  is 
time-phased  relative  to  the  design,  verification,  production,  and 
operational  phases  of  the  equipment  lifetime.  The  Army  structural 
integrity  program  should  be  sufficiently  general  that  it  defines 
structural  integrity  requirements  and  outlines  the  essential  features  of 
a  satisfactory  (adequate)  structural  integrity  plan  for  a  given 
procurement.  It  is  essential  that  the  new  military  standard  give  serious 
consideration  to  how  structural  integrity  requirements  will  be  verified 
prior  to  acceptance  of  design  for  production  release.  Chapter  3  provides 
a  number  of  examples  of  structural  integrity  programs  that  might  be 
reviewed  for  their  relevance  to  this  new  military  standard. 

IMPLEMENTATION 

It  is  the  committees'  belief  that  the  Army  must  develop  its  own 
structural  integrity  plan  reflecting  the  specific  character, 
organization,  and  operational  procedures  unique  to  that  branch  of  the 
service.  Implementation  should  be  by  directive  from  the  highest  level  of 
the  Army.  The  committee  has  not  involved  itself  with  the  details  of  the 
organization  and  operational  aspects  of  such  a  plan  for  the  Army, 
considering  this  to  be  outside  its  area  of  knowledge  and  experience,  but 
recommends  that  such  be  done  by  the  Army  itself,  following  closely  the 
guidelines  given  in  this  chapter. 

PAYOKKS 

The  importance  to  the  Army  of  operating  with  a  structural  integrity 
plan  involves  far  more  than  the  mere  practice  of  sound  engineering 
principles.  The  committee  has  identified  six  factors  that  could  be  used 
to  measure  possible  payoffs  from  the  introduction  of  such  procedures  into 
the  procurement  process: 

l.  Cost — Although  the  "costs"  of  a  malfunctioning  or  otherwise 
defective  part  are  difficult  to  measure,  they  can  be  very  high.  For 
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example,  as  indicated  in  Chapter  1,  the  cost  of  fractures  each  year  in 
the  United  States  has  been  estimated  to  be  in  excess  of  $100  billion  with 
some  $6  billion  of  that  directed  to  the  DOD. 

2.  Safety — Protection  of  the  public  as  well  as  military  personnel 
against  a  serious  accident  involving  Army  weapons  is  of  prime 
importance.  Of  special  concern  are  those  systems  involving  nuclear 
weapons.  However,  the  more  conventional  weapons  (e.g.,  the  LAW  and 
artillery)  are  also  of  concern  since  premature  ignition  of  projectiles  or 
inadequate  toughness  and  sudden  fracture  of  gun  barrels  can  lead  to 
injury  and  loss  of  life.  Problems  associated  with  loss  of  confidence  and 
morale  of  operating  personnel  can  also  result  if  the  accident  rate  is 
high. 

3.  Readiness  (reliability  and  performance) — An  inoperative  weapon  or 
vehicle  at  a  time  of  national  emergency  is  an  extremely  serious  problem. 
Although  difficult  to  quantify  in  dollars,  there  can  be  no  justification 
for  the  existence  of  a  weapons  system  that  is  not  available  for  use  in 
time  of  need  due  to  a  "structural  failure." 

4.  Visibility — The  unsuccessful  performance  of  a  new  weapons  system 
during  its  various  trials  prior  to  commission  can  generate  unfavorable 
publicity  that  has  serious  consequences  in  terms  of  both  public  and 
congressional  opinion  concerning  the  capability  of  the  Army  to  undertake 
and  satisfactorily  complete  such  projects.  Although  a  structural 
integrity  plan  will  not  prevent  all  possible  operational  problems,  it  can 
help  avoid  many  of  these  embarrassments. 

5.  Maintenance — Undue  maintenance  because  of  repeated  malfunction 
can  have  serious  economic  and  operational  consequences.  Skyrocketing 
repair  costs  hav  serious  budgetary  consequences.  Excess  downtime  means 
more  equipment  must  be  procured  to  perform  a  given  function.  Breakdowns 
in  remote  locations  are  extremely  costly. 

6.  Politics — A  positive  attitude  in  the  mind  of  the  public  and 
particularly  the  Congress  is  highly  desirable  if  a  given  weapons  system 
is  to  be  adequately  funded.  The  several  factors  given  above  all 
contribute  to  the  development  of  this  attitude. 

The  four  weapons  systems  described  in  Chapter  4  have  been  examined  in 
terms  of  these  factors  and  it  was  concluded  that  a  more  comprehensive 
structural  integrity  plan  in  place  in  advance  would  have  prevented  or 
could  have  prevented  the  difficulties  experienced.  An  attempt  has  been 
made  by  the  committee  to  evaluate  the  several  payoff  factors  described 
above  for  each  of  these  systems.  This  evaluation  was  aimed  at  measuring 
the  relative  importance  of  each  payoff  factor  on  a  scale  of  one  to  six, 
where  one  is  most  important  and  six  the  least  important  of  the  several 
factors  identified.  While  only  representing  the  views  of  the  committee, 
it  wa3  clear  that  safety  was  the  most  important  of  the  various  payoff 
factors  and  maintenance  the  least.  While  other  groups  might  come  up  with 
a  different  ranking,  ours  was,  in  order  of  importance,  safety,  readiness, 
political  factors,  cost,  visibility,  and  maintenance. 
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